diff --git a/.eslintrc.js b/.eslintrc.js
index a57ea5e03865a1..2c55dd2528ef14 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -470,11 +470,6 @@ module.exports = {
                 errorMessage:
                   'Server modules cannot be imported into client modules or shared modules.',
               },
-              {
-                target: ['src/**/*'],
-                from: ['x-pack/**/*'],
-                errorMessage: 'OSS cannot import x-pack files.',
-              },
               {
                 target: ['src/core/**/*'],
                 from: ['plugins/**/*', 'src/plugins/**/*'],
diff --git a/.i18nrc.json b/.i18nrc.json
index 68bb343092f259..235b65d7502f4f 100644
--- a/.i18nrc.json
+++ b/.i18nrc.json
@@ -9,6 +9,7 @@
     "data": "src/plugins/data",
     "embeddableApi": "src/plugins/embeddable",
     "embeddableExamples": "examples/embeddable_examples",
+    "fieldFormats": "src/plugins/field_formats",
     "uiActionsExamples": "examples/ui_action_examples",
     "share": "src/plugins/share",
     "home": "src/plugins/home",
@@ -35,6 +36,7 @@
     "monaco": "packages/kbn-monaco/src",
     "esQuery": "packages/kbn-es-query/src",
     "presentationUtil": "src/plugins/presentation_util",
+    "indexPatternEditor": "src/plugins/index_pattern_editor",
     "indexPatternFieldEditor": "src/plugins/index_pattern_field_editor",
     "indexPatternManagement": "src/plugins/index_pattern_management",
     "interactiveSetup": "src/plugins/interactive_setup",
diff --git a/api_docs/timelines.json b/api_docs/timelines.json
index f273ee5fc24ba5..42943819522168 100644
--- a/api_docs/timelines.json
+++ b/api_docs/timelines.json
@@ -10918,7 +10918,7 @@
             "label": "alertConsumers",
             "description": [],
             "signature": [
-              "ALERTS_CONSUMERS",
+              "AlertConsumers",
               "[] | undefined"
             ],
             "path": "x-pack/plugins/timelines/common/search_strategy/timeline/index.ts",
diff --git a/dev_docs/tutorials/testing_plugins.mdx b/dev_docs/tutorials/testing_plugins.mdx
new file mode 100644
index 00000000000000..96e13555a36a26
--- /dev/null
+++ b/dev_docs/tutorials/testing_plugins.mdx
@@ -0,0 +1,1367 @@
+---
+id: kibDevTutorialTestingPlugins
+slug: /kibana-dev-docs/tutorial/testing-plugins
+title: Testing Kibana Plugins
+summary: Learn how to test different aspects of Kibana plugins
+date: 2021-07-05
+tags: ['kibana', 'onboarding', 'dev', 'architecture', 'testing']
+---
+
+This document outlines best practices and patterns for testing Kibana Plugins.
+
+## Strategy
+
+In general, we recommend three tiers of tests:
+- Unit tests: small, fast, exhaustive, make heavy use of mocks for external dependencies 
+- Integration tests: higher-level tests that verify interactions between systems (eg. HTTP APIs, Elasticsearch API calls, calling other plugin contracts).
+- End-to-end tests (e2e): tests that verify user-facing behavior through the browser
+
+These tiers should roughly follow the traditional ["testing pyramid"](https://martinfowler.com/articles/practical-test-pyramid.html), where there are more exhaustive testing at the unit level, fewer at the integration level, and very few at the functional level. 
+
+## Core Integrations
+
+### Core Mocks
+
+When testing a plugin's integration points with Core APIs, it is heavily recommended to utilize the mocks provided in `src/core/server/mocks` and `src/core/public/mocks`. The majority of these mocks are dumb `jest` mocks that mimic the interface of their respective Core APIs, however they do not return realistic return values.
+
+If the unit under test expects a particular response from a Core API, the test will need to set this return value explicitly. The return values are type checked to match the Core API where possible to ensure that mocks are updated when Core APIs changed.
+
+#### Example
+
+```typescript
+import { elasticsearchServiceMock } from 'src/core/server/mocks';
+
+test('my test', async () => {
+  // Setup mock and faked response
+  const esClient = elasticsearchServiceMock.createScopedClusterClient();
+  esClient.callAsCurrentUser.mockResolvedValue(/** insert ES response here */);
+
+  // Call unit under test with mocked client
+  const result = await myFunction(esClient);
+
+  // Assert that client was called with expected arguments
+  expect(esClient.callAsCurrentUser).toHaveBeenCalledWith(/** expected args */);
+  // Expect that unit under test returns expected value based on client's response
+  expect(result).toEqual(/** expected return value */)
+});
+```
+
+## Strategies for specific Core APIs
+
+### HTTP Routes
+The HTTP API interface is another public contract of Kibana, although not every Kibana endpoint is for external use. When evaluating the required level of test coverage for an HTTP resource, make your judgment based on whether an endpoint is considered to be public or private. Public API is expected to have a higher level of test coverage.
+Public API tests should cover the **observable behavior** of the system, therefore they should be close to the real user interactions as much as possible, ideally by using HTTP requests to communicate with the Kibana server as a real user would do.
+
+##### Preconditions
+We are going to add tests for `myPlugin` plugin that allows to format user-provided text, store and retrieve it later.
+The plugin has *thin* route controllers isolating all the network layer dependencies and delegating all the logic to the plugin model.
+
+```typescript
+class TextFormatter {
+  public static async format(text: string, sanitizer: Deps['sanitizer']) {
+    // sanitizer.sanitize throws MisformedTextError when passed text contains HTML markup
+    const sanitizedText = await sanitizer.sanitize(text); 
+    return sanitizedText;
+  }
+
+  public static async save(text: string, savedObjectsClient: SavedObjectsClient) {
+    const { id } = await savedObjectsClient.update('myPlugin-type', 'myPlugin', {
+      userText: text
+    });
+    return { id };
+  }
+
+  public static async getById(id: string, savedObjectsClient: SavedObjectsClient) {
+    const { attributes } = await savedObjectsClient.get('myPlugin-type', id);
+    return { text: attributes.userText };
+  }
+}
+router.get(
+  {
+    path: '/myPlugin/formatter',
+    validate: {
+      query: schema.object({
+        text: schema.string({ maxLength: 100 }),
+      }),
+    },
+  },
+  async (context, request, response) => {
+    try {
+      const formattedText = await TextFormatter.format(request.query.text, deps.sanitizer);
+      return response.ok({ body: formattedText });
+    } catch(error) {
+      if (error instanceof MisformedTextError) {
+        return response.badRequest({ body: error.message })
+      }
+
+      throw e;
+    }
+  }
+);
+router.post(
+  {
+    path: '/myPlugin/formatter/text',
+    validate: {
+      body: schema.object({
+        text: schema.string({ maxLength: 100 }),
+      }),
+    },
+  },
+  async (context, request, response) => {
+    try {
+      const { id } = await TextFormatter.save(request.query.text, context.core.savedObjects.client);
+      return response.ok({ body: { id } });
+    } catch(error) {
+      if (SavedObjectsErrorHelpers.isConflictError(error)) {
+        return response.conflict({ body: error.message })
+      }
+      throw e;
+    }
+  }
+);
+
+router.get(
+  {
+    path: '/myPlugin/formatter/text/{id}',
+    validate: {
+      params: schema.object({
+        id: schema.string(),
+      }),
+    },
+  },
+  async (context, request, response) => {
+    try {
+      const { text } = await TextFormatter.getById(request.params.id, context.core.savedObjects.client);
+      return response.ok({
+        body: text
+      });
+    } catch(error) {
+      if (SavedObjectsErrorHelpers.isNotFoundError(error)) {
+        return response.notFound()
+      }
+      throw e;
+    }
+  }
+);
+```
+
+#### Unit testing
+Unit tests provide the simplest and fastest way to test the logic in your route controllers and plugin models. 
+Use them whenever adding an integration test is hard and slow due to complex setup or the number of logic permutations.
+Since all external core and plugin dependencies are mocked, you don't have the guarantee that the whole system works as
+expected.
+
+Pros:
+- fast
+- easier to debug
+
+Cons:
+- doesn't test against real dependencies
+- doesn't cover integration with other plugins
+
+###### Example
+You can leverage existing unit-test infrastructure for this. You should add `*.test.ts` file and use dependencies mocks to cover the functionality with a broader test suit that covers:
+- input permutations
+- input edge cases
+- expected exception
+- interaction with dependencies
+```typescript
+// src/plugins/my_plugin/server/formatter.test.ts
+describe('TextFormatter', () => {
+  describe('format()', () => {
+    const sanitizer = sanitizerMock.createSetup();
+    sanitizer.sanitize.mockImplementation((input: string) => `sanitizer result:${input}`);
+
+    it('formats text to a ... format', async () => {
+      expect(await TextFormatter.format('aaa', sanitizer)).toBe('...');
+    });
+
+    it('calls Sanitizer.sanitize with correct arguments', async () => {
+      await TextFormatter.format('aaa', sanitizer);
+      expect(sanitizer.sanitize).toHaveBeenCalledTimes(1);
+      expect(sanitizer.sanitize).toHaveBeenCalledWith('aaa');
+    });
+
+    it('throws MisformedTextError if passed string contains banned symbols', async () => {
+      sanitizer.sanitize.mockRejectedValueOnce(new MisformedTextError());
+      await expect(TextFormatter.format('any', sanitizer)).rejects.toThrow(MisformedTextError);
+    });
+    // ... other tests
+  });
+});
+```
+
+#### Integration tests
+Depending on the number of external dependencies, you can consider implementing several high-level integration tests. 
+They would work as a set of [smoke tests](https://en.wikipedia.org/wiki/Smoke_testing_(software)) for the most important functionality.
+
+Main subjects for tests should be:
+- authenticated / unauthenticated access to an endpoint.
+- endpoint validation (params, query, body).
+- main business logic.
+- dependencies on other plugins.
+
+##### Functional Test Runner
+If your plugin relies on the elasticsearch server to store data and supports additional configuration, you can leverage the Functional Test Runner(FTR) to implement integration tests. 
+FTR bootstraps an elasticsearch and a Kibana instance and runs the test suite against it.
+
+Pros:
+- runs the whole Elastic stack
+- tests cross-plugin integration
+- emulates a real user interaction with the stack
+- allows adjusting config values
+
+Cons:
+- slow start
+- hard to debug
+- brittle tests
+
+###### Example
+You can reuse existing [api_integration](https://github.com/elastic/kibana/blob/master/test/api_integration/config.js) setup by registering a test file within a
+[test loader](https://github.com/elastic/kibana/blob/master/test/api_integration/apis/index.ts). More about the existing FTR setup in the
+[contribution guide](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#running-specific-kibana-tests)
+
+The tests cover:
+- authenticated / non-authenticated user access (when applicable)
+```typescript
+// test/api_integration/apis/my_plugin/something.ts
+export default function({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
+  const security = getService('security');
+
+  describe('myPlugin', () => {
+    it('returns limited info when not authenticated', async () => {
+      await security.logout();
+      const response = await supertest
+        .get('/myPlugin/health')
+        .set('content-type', 'application/json')
+        .expect(200);
+    
+      expect(response.body).to.have.property('basicInfo');
+      expect(response.body).not.to.have.property('detailedInfo');
+    });
+
+    it('returns detailed info when authenticated', async () => {
+      await security.loginAsSuperUser();
+      const response = await supertest
+        .get('/myPlugin/health')
+        .set('content-type', 'application/json')
+        .expect(200);
+    
+      expect(response.body).to.have.property('basicInfo');
+      expect(response.body).to.have.property('detailedInfo');
+    });
+  });
+```
+- request validation
+```typescript
+// test/api_integration/apis/my_plugin/something.ts
+export default function({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
+
+  describe('myPlugin', () => {
+    it('validate params before to store text', async () => {
+      const response = await supertest
+        .post('/myPlugin/formatter/text')
+        .set('content-type', 'application/json')
+        .send({ text: 'aaa'.repeat(100) })
+        .expect(400);
+
+      expect(response.body).to.have.property('message');
+      expect(response.body.message).to.contain('must have a maximum length of [100]');
+    });
+  });
+```
+- the main logic of the plugin
+```typescript
+export default function({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
+  describe('myPlugin', () => {
+    it('stores text', async () => {
+      const response = await supertest
+        .post('/myPlugin/formatter/text')
+        .set('content-type', 'application/json')
+        .send({ text: 'aaa' })
+        .expect(200);
+
+      expect(response.body).to.have.property('id');
+      expect(response.body.id).to.be.a('string');
+    });
+
+    it('retrieves text', async () => {
+      const { body } = await supertest
+        .post('/myPlugin/formatter/text')
+        .set('content-type', 'application/json')
+        .send({ text: 'bbb' })
+        .expect(200);
+
+      const response = await supertest.get(`/myPlugin/formatter/text/${body.id}`).expect(200);
+      expect(response.text).be('bbb');
+    });
+
+    it('returns NotFound error when cannot find a text', async () => {
+      await supertest
+        .get('/myPlugin/something/missing')
+        .expect(404, 'Saved object [myPlugin-type/missing] not found');
+    });
+  });
+```
+
+##### TestUtils
+It can be utilized if your plugin doesn't interact with the elasticsearch server or mocks the own methods doing so.
+Runs tests against real Kibana server instance.
+
+Pros:
+- runs the real Kibana instance
+- tests cross-plugin integration
+- emulates a real user interaction with the HTTP resources
+
+Cons:
+- faster than FTR because it doesn't run elasticsearch instance, but still slow
+- hard to debug
+- doesn't cover Kibana CLI logic
+
+###### Example
+To have access to Kibana TestUtils, you should create `integration_tests` folder and import `test_utils` within a test file:
+```typescript
+// src/plugins/my_plugin/server/integration_tests/formatter.test.ts
+import * as kbnTestServer from 'src/core/test_helpers/kbn_server';
+
+describe('myPlugin', () => {
+  describe('GET /myPlugin/formatter', () => {
+    let root: ReturnType<typeof kbnTestServer.createRoot>;
+    beforeAll(async () => {
+      root = kbnTestServer.createRoot();
+      await root.preboot();
+      await root.setup();
+      await root.start();
+    }, 30000);
+
+    afterAll(async () => await root.shutdown());
+    it('validates given text', async () => {
+      const response = await kbnTestServer.request
+        .get(root, '/myPlugin/formatter')
+        .query({ text: 'input string'.repeat(100) })
+        .expect(400);
+
+      expect(response.body).toHaveProperty('message');
+    });
+
+    it('formats given text', async () => {
+      const response = await kbnTestServer.request
+        .get(root, '/myPlugin/formatter')
+        .query({ text: 'input string' })
+        .expect(200);
+
+      expect(response.text).toBe('...');
+    });
+
+    it('returns BadRequest if passed string contains banned symbols', async () => {
+      await kbnTestServer.request
+        .get(root, '/myPlugin/formatter')
+        .query({ text: '<script>' })
+        .expect(400, 'Text cannot contain unescaped HTML markup.');
+    });
+  });
+});
+```
+Sometimes we want to test a route controller logic and don't rely on the internal logic of the platform or a third-party plugin. 
+Then we can apply a hybrid approach and mock the necessary method of `TextFormatter` model to test how `MisformedTextError`
+handled in the route handler without calling `sanitizer` dependency directly.
+```typescript
+jest.mock('../path/to/model');
+import { TextFormatter } from '../path/to/model';
+import { MisformedTextError } from '../path/to/sanitizer'
+
+describe('myPlugin', () => {
+  describe('GET /myPlugin/formatter', () => {
+    let root: ReturnType<typeof kbnTestServer.createRoot>;
+    beforeAll(async () => {
+      root = kbnTestServer.createRoot();
+      await root.preboot();
+      await root.setup();
+      await root.start();
+    }, 30000);
+
+    afterAll(async () => await root.shutdown());
+    it('returns BadRequest if Sanitizer throws MisformedTextError', async () => {
+      TextFormatter.format.mockRejectedValueOnce(new MisformedTextError());
+
+      await kbnTestServer.request
+        .get(root, '/myPlugin/formatter')
+        .query({ text: 'any text' })
+        .expect(400, 'bad bad request');
+    });
+  });
+});
+```
+
+### Applications
+
+Kibana Platform applications have less control over the page than legacy applications did. It is important that your app is built to handle it's co-habitance with other plugins in the browser. Applications are mounted and unmounted from the DOM as the user navigates between them, without full-page refreshes, as a single-page application (SPA). 
+
+These long-lived sessions make cleanup more important than before. It's entirely possible a user has a single browsing session open for weeks at a time, without ever doing a full-page refresh. Common things that need to be cleaned up (and tested!) when your application is unmounted:
+- Subscriptions and polling (eg. `uiSettings.get$()`)
+- Any Core API calls that set state (eg. `core.chrome.setIsVisible`).
+- Open connections (eg. a Websocket)
+
+While applications do get an opportunity to unmount and run cleanup logic, it is also important that you do not _depend_ on this logic to run. The browser tab may get closed without running cleanup logic, so it is not guaranteed to be run. For instance, you should not depend on unmounting logic to run in order to save state to `localStorage` or to the backend.
+
+#### Example
+
+By following the [renderApp](https://github.com/elastic/kibana/blob/master/src/core/CONVENTIONS.md#applications) convention, you can greatly reduce the amount of logic in your application's mount function. This makes testing your application's actual rendering logic easier.
+
+```typescript jsx
+/** public/plugin.ts */
+class Plugin {
+  setup(core) {
+    core.application.register({
+      // id, title, etc.
+      async mount(params) {
+        const [{ renderApp }, [coreStart, startDeps]] = await Promise.all([
+          import('./application'),
+          core.getStartServices()
+        ]);
+
+        return renderApp(params, coreStart, startDeps);
+      }
+    })
+  }
+}
+```
+
+We _could_ still write tests for this logic, but you may find that you're just asserting the same things that would be covered by type-checks.
+
+<details>
+<summary>See example</summary>
+
+```typescript
+/** public/plugin.test.ts */
+jest.mock('./application', () => ({ renderApp: jest.fn() }));
+import { coreMock } from 'src/core/public/mocks';
+import { renderApp: renderAppMock } from './application';
+import { Plugin } from './plugin';
+
+describe('Plugin', () => {
+  it('registers an app', () => {
+    const coreSetup = coreMock.createSetup();
+    new Plugin(coreMock.createPluginInitializerContext()).setup(coreSetup);
+    expect(coreSetup.application.register).toHaveBeenCalledWith({
+      id: 'myApp',
+      mount: expect.any(Function)
+    });
+  });
+
+  // Test the glue code from Plugin -> renderApp
+  it('application.mount wires up dependencies to renderApp', async () => {
+    const coreSetup = coreMock.createSetup();
+    const [coreStartMock, startDepsMock] = await coreSetup.getStartServices();
+    const unmountMock = jest.fn();
+    renderAppMock.mockReturnValue(unmountMock);
+    const params = coreMock.createAppMountParamters('/fake/base/path');
+
+    new Plugin(coreMock.createPluginInitializerContext()).setup(coreSetup);
+    // Grab registered mount function
+    const mount = coreSetup.application.register.mock.calls[0][0].mount;
+
+    const unmount = await mount(params);
+    expect(renderAppMock).toHaveBeenCalledWith(params, coreStartMock, startDepsMock);
+    expect(unmount).toBe(unmountMock);
+  });
+});
+```
+
+</details>
+
+The more interesting logic is in `renderApp`:
+
+```typescript
+/** public/application.ts */
+import React from 'react';
+import ReactDOM from 'react-dom';
+
+import { AppMountParameters, CoreStart } from 'src/core/public';
+import { AppRoot } from './components/app_root';
+
+export const renderApp = (
+  { element, history }: AppMountParameters,
+  core: CoreStart,
+  plugins: MyPluginDepsStart
+) => {
+  // Hide the chrome while this app is mounted for a full screen experience
+  core.chrome.setIsVisible(false);
+
+  // uiSettings subscription
+  const uiSettingsClient = core.uiSettings.client;
+  const pollingSubscription = uiSettingClient.get$('mysetting1').subscribe(async mySetting1 => {
+    const value = core.http.fetch(/** use `mySetting1` in request **/);
+    // ...
+  });
+
+  // Render app
+  ReactDOM.render(
+    <AppRoot routerHistory={history} core={core} plugins={plugins} />,
+    element
+  );
+
+  return () => {
+    // Unmount UI
+    ReactDOM.unmountComponentAtNode(element);
+    // Close any subscriptions
+    pollingSubscription.unsubscribe();
+    // Make chrome visible again
+    core.chrome.setIsVisible(true);
+  };
+};
+```
+
+In testing `renderApp` you should be verifying that:
+1) Your application mounts and unmounts correctly
+2) Cleanup logic is completed as expected
+
+```typescript
+/** public/application.test.ts */
+import { createMemoryHistory } from 'history';
+import { ScopedHistory } from 'src/core/public';
+import { coreMock } from 'src/core/public/mocks';
+import { renderApp } from './application';
+
+describe('renderApp', () => {
+  it('mounts and unmounts UI', () => {
+    const params = coreMock.createAppMountParamters('/fake/base/path');
+    const core = coreMock.createStart();
+
+    // Verify some expected DOM element is rendered into the element
+    const unmount = renderApp(params, core, {});
+    expect(params.element.querySelector('.some-app-class')).not.toBeUndefined();
+    // Verify the element is empty after unmounting
+    unmount();
+    expect(params.element.innerHTML).toEqual('');
+  });
+
+  it('unsubscribes from uiSettings', () => {
+    const params = coreMock.createAppMountParamters('/fake/base/path');
+    const core = coreMock.createStart();
+    // Create a fake Subject you can use to monitor observers
+    const settings$ = new Subject();
+    core.uiSettings.get$.mockReturnValue(settings$);
+
+    // Verify mounting adds an observer
+    const unmount = renderApp(params, core, {});
+    expect(settings$.observers.length).toBe(1);
+    // Verify no observers remaining after unmount is called
+    unmount();
+    expect(settings$.observers.length).toBe(0);
+  });
+
+  it('resets chrome visibility', () => {
+    const params = coreMock.createAppMountParamters('/fake/base/path');
+    const core = coreMock.createStart();
+
+    // Verify stateful Core API was called on mount
+    const unmount = renderApp(params, core, {});
+    expect(core.chrome.setIsVisible).toHaveBeenCalledWith(false);
+    core.chrome.setIsVisible.mockClear(); // reset mock
+    // Verify stateful Core API was called on unmount
+    unmount();
+    expect(core.chrome.setIsVisible).toHaveBeenCalledWith(true);
+  })
+});
+```
+
+### SavedObjects
+
+#### Unit Tests
+
+To unit test code that uses the Saved Objects client mock the client methods
+and make assertions against the behaviour you would expect to see.
+
+Since the Saved Objects client makes network requests to an external
+Elasticsearch cluster, it's important to include failure scenarios in your
+test cases.
+
+When writing a view with which a user might interact, it's important to ensure
+your code can recover from exceptions and provide a way for the user to
+proceed. This behaviour should be tested as well.
+
+Below is an example of a Jest Unit test suite that mocks the server-side Saved
+Objects client:
+
+```typescript
+// src/plugins/myplugin/server/lib/short_url_lookup.ts
+import crypto from 'crypto';
+import { SavedObjectsClientContract } from 'kibana/server';
+
+export const shortUrlLookup = {
+  generateUrlId(url: string, savedObjectsClient: SavedObjectsClientContract) {
+    const id = crypto
+      .createHash('md5')
+      .update(url)
+      .digest('hex');
+
+    return savedObjectsClient
+      .create(
+        'url',
+        {
+          url,
+          accessCount: 0,
+          createDate: new Date().valueOf(),
+          accessDate: new Date().valueOf(),
+        },
+        { id }
+      )
+      .then(doc => doc.id)
+      .catch(err => {
+        if (savedObjectsClient.errors.isConflictError(err)) {
+          return id;
+        } else {
+          throw err;
+        }
+      });
+  },
+};
+
+```
+
+```typescript
+// src/plugins/myplugin/server/lib/short_url_lookup.test.ts
+import { shortUrlLookup } from './short_url_lookup';
+import { savedObjectsClientMock } from '../../../../../core/server/mocks';
+
+describe('shortUrlLookup', () => {
+  const ID = 'bf00ad16941fc51420f91a93428b27a0';
+  const TYPE = 'url';
+  const URL = 'http://elastic.co';
+
+  const mockSavedObjectsClient = savedObjectsClientMock.create();
+
+  beforeEach(() => {
+    jest.resetAllMocks();
+  });
+
+  describe('generateUrlId', () => {
+    it('provides correct arguments to savedObjectsClient', async () => {
+      const ATTRIBUTES = {
+        url: URL,
+        accessCount: 0,
+        createDate: new Date().valueOf(),
+        accessDate: new Date().valueOf(),
+      };
+      mockSavedObjectsClient.create.mockResolvedValueOnce({
+        id: ID,
+        type: TYPE,
+        references: [],
+        attributes: ATTRIBUTES,
+      });
+      await shortUrlLookup.generateUrlId(URL, mockSavedObjectsClient);
+
+      expect(mockSavedObjectsClient.create).toHaveBeenCalledTimes(1);
+      const [type, attributes, options] = mockSavedObjectsClient.create.mock.calls[0];
+      expect(type).toBe(TYPE);
+      expect(attributes).toStrictEqual(ATTRIBUTES);
+      expect(options).toStrictEqual({ id: ID });
+    });
+
+    it('ignores version conflict and returns id', async () => {
+      mockSavedObjectsClient.create.mockRejectedValueOnce(
+        mockSavedObjectsClient.errors.decorateConflictError(new Error())
+      );
+      const id = await shortUrlLookup.generateUrlId(URL, mockSavedObjectsClient);
+      expect(id).toEqual(ID);
+    });
+
+    it('rejects with passed through savedObjectsClient errors', () => {
+      const error = new Error('oops');
+      mockSavedObjectsClient.create.mockRejectedValueOnce(error);
+      return expect(shortUrlLookup.generateUrlId(URL, mockSavedObjectsClient)).rejects.toBe(error);
+    });
+  });
+});
+```
+
+The following is an example of a public saved object unit test. The biggest
+difference with the server-side test is the slightly different Saved Objects
+client API which returns `SimpleSavedObject` instances which needs to be
+reflected in the mock.
+
+```typescript
+// src/plugins/myplugin/public/saved_query_service.ts
+import {
+  SavedObjectsClientContract,
+  SavedObjectAttributes,
+  SimpleSavedObject,
+} from 'src/core/public';
+
+export type SavedQueryAttributes = SavedObjectAttributes & {
+  title: string;
+  description: 'bar';
+  query: {
+    language: 'kuery';
+    query: 'response:200';
+  };
+};
+
+export const createSavedQueryService = (savedObjectsClient: SavedObjectsClientContract) => {
+  const saveQuery = async (
+    attributes: SavedQueryAttributes
+  ): Promise<SimpleSavedObject<SavedQueryAttributes>> => {
+    try {
+      return await savedObjectsClient.create<SavedQueryAttributes>('query', attributes, {
+        id: attributes.title as string,
+      });
+    } catch (err) {
+      throw new Error('Unable to create saved query, please try again.');
+    }
+  };
+
+  return {
+    saveQuery,
+  };
+};
+```
+
+```typescript
+// src/plugins/myplugin/public/saved_query_service.test.ts
+import { createSavedQueryService, SavedQueryAttributes } from './saved_query_service';
+import { savedObjectsServiceMock } from '../../../../../core/public/mocks';
+import { SavedObjectsClientContract, SimpleSavedObject } from '../../../../../core/public';
+
+describe('saved query service', () => {
+  const savedQueryAttributes: SavedQueryAttributes = {
+    title: 'foo',
+    description: 'bar',
+    query: {
+      language: 'kuery',
+      query: 'response:200',
+    },
+  };
+
+  const mockSavedObjectsClient = savedObjectsServiceMock.createStartContract()
+    .client as jest.Mocked<SavedObjectsClientContract>;
+
+  const savedQueryService = createSavedQueryService(mockSavedObjectsClient);
+
+  afterEach(() => {
+    jest.resetAllMocks();
+  });
+
+  describe('saveQuery', function() {
+    it('should create a saved object for the given attributes', async () => {
+      // The public Saved Objects client returns instances of
+      // SimpleSavedObject, so we create an instance to return from our mock.
+      const mockReturnValue = new SimpleSavedObject(mockSavedObjectsClient, {
+        type: 'query',
+        id: 'foo',
+        attributes: savedQueryAttributes,
+        references: [],
+      });
+      mockSavedObjectsClient.create.mockResolvedValue(mockReturnValue);
+
+      const response = await savedQueryService.saveQuery(savedQueryAttributes);
+      expect(mockSavedObjectsClient.create).toHaveBeenCalledWith('query', savedQueryAttributes, {
+        id: 'foo',
+      });
+      expect(response).toBe(mockReturnValue);
+    });
+
+    it('should reject with an error when saved objects client errors', async done => {
+      mockSavedObjectsClient.create.mockRejectedValue(new Error('timeout'));
+
+      try {
+        await savedQueryService.saveQuery(savedQueryAttributes);
+      } catch (err) {
+        expect(err).toMatchInlineSnapshot(
+          `[Error: Unable to create saved query, please try again.]`
+        );
+        done();
+      }
+    });
+  });
+});
+```
+
+#### Integration Tests
+To get the highest confidence in how your code behaves when using the Saved
+Objects client, you should write at least a few integration tests which loads
+data into and queries a real Elasticsearch database.
+
+To do that we'll write a Jest integration test using `TestUtils` to start
+Kibana and esArchiver to load fixture data into Elasticsearch.
+
+1. Create the fixtures data you need in Elasticsearch
+2. Create a fixtures archive with `node scripts/es_archiver save <path> [index patterns...]`
+3. Load the fixtures in your test using esArchiver `esArchiver.load('path from root of repo')`;
+
+_todo: fully worked out example_
+
+### Elasticsearch
+
+_How to test ES clients_
+
+## Plugin integrations
+
+In the Kibana Platform, all plugin's dependencies to other plugins are explicitly declared in their `kibana.json`
+manifest. As for `core`, the dependencies `setup` and `start` contracts are injected in your plugin's respective 
+`setup` and `start` phases. One of the upsides with testing is that every usage of the dependencies is explicit,
+and that the plugin's contracts must be propagated to the parts of the code using them, meaning that isolating a 
+specific logical component for unit testing is way easier than in legacy.
+
+The approach to test parts of a plugin's code that is relying on other plugins is quite similar to testing
+code using `core` APIs: it's expected to mock the dependency, and make it return the value the test is expecting.
+
+Most plugins are defining mocks for their contracts. The convention is to expose them in a `mocks` file  in 
+`my_plugin/server` and/or `my_plugin/public`. For example for the `data` plugin, the client-side mocks are located in 
+`src/plugins/data/public/mocks.ts`. When such mocks are present, it's strongly recommended to use them
+when testing against dependencies. Otherwise, one should create it's own mocked implementation of the dependency's
+contract (and should probably ping the plugin's owner to ask them to add proper contract mocks).
+
+### Preconditions
+
+For these examples, we are going to see how we should test the `myPlugin` plugin.
+ 
+This plugin declares the `data` plugin as  a `required` dependency and the `usageCollection` plugin as an `optional` 
+one. It also exposes a `getSpecialSuggestions` API in it's start contract, which relies on the `data` plugin to retrieve
+data.
+
+`MyPlugin` plugin definition:
+
+```typescript
+// src/plugins/myplugin/public/plugin.ts
+import { METRIC_TYPE } from '@kbn/analytics';
+import { CoreSetup, CoreStart, Plugin } from 'kibana/public';
+import { DataPublicPluginSetup, DataPublicPluginStart } from '../../data/public';
+import { UsageCollectionSetup } from '../../usage_collection/public';
+import { SuggestionsService } from './suggestions';
+
+interface MyPluginSetupDeps {
+  data: DataPublicPluginSetup;
+  usageCollection?: UsageCollectionSetup;
+}
+
+interface MyPluginStartDeps {
+  data: DataPublicPluginStart;
+}
+
+export class MyPlugin implements Plugin<MyPluginSetup, MyPluginStart, MyPluginSetupDeps, MyPluginStartDeps> {
+  private suggestionsService = new SuggestionsService();
+
+  public setup(core: CoreSetup, { data, usageCollection }: MyPluginSetupDeps) {
+    // setup our internal service
+    this.suggestionsService.setup(data);
+
+    // an example on using an optional dependency that will be tested
+    if (usageCollection) {
+      usageCollection.reportUiCounter('my_plugin', METRIC_TYPE.LOADED, 'my_event');
+    }
+    // or in a shorter version
+    usageCollection?.reportUiCounter('my_plugin', METRIC_TYPE.LOADED, 'my_event');
+
+    return {};
+  }
+
+  public start(core: CoreStart, { data }: MyPluginStartDeps) {
+    const suggestions = this.suggestionsService.start(data);
+    return {
+      getSpecialSuggestions: (query: string) => suggestions.getSuggestions(query),
+    };
+  }
+
+  public stop() {}
+}
+
+export type MyPluginSetup = ReturnType<MyPlugin['setup']>;
+export type MyPluginStart = ReturnType<MyPlugin['start']>;
+```
+
+The underlying `SuggestionsService` implementation:
+
+```typescript
+// src/plugins/myplugin/public/suggestions/suggestion_service.ts
+import { DataPublicPluginSetup, DataPublicPluginStart } from '../../../data/public';
+
+// stubs for testing purposes
+const suggestDependingOn = (...args: any[]) => [];
+const baseOptions = {} as any;
+export const defaultSuggestions = [
+  {
+    text: 'a default suggestion',
+  },
+] as any[];
+
+export class SuggestionsService {
+  public setup(data: DataPublicPluginSetup) {
+    // register a suggestion provider to the `data` dependency plugin
+    data.autocomplete.addQuerySuggestionProvider('fr', async args => {
+      return suggestDependingOn(args);
+    });
+  }
+
+  public start(data: DataPublicPluginStart) {
+    return {
+      getSuggestions: async (query: string) => {
+        // use the `data` plugin contract to retrieve arbitrary data
+        // note: this logic does not really make any sense and is only here to introduce a behavior to test
+        const baseSuggestions = await data.autocomplete.getQuerySuggestions({
+          ...baseOptions,
+          query,
+        });
+        if (!baseSuggestions || baseSuggestions.length === 0) {
+          return defaultSuggestions;
+        }
+        return baseSuggestions.filter(suggestion => suggestion.type !== 'conjunction');
+      },
+    };
+  }
+}
+```
+
+### Testing dependencies usages
+
+A plugin should test expected usage and calls on it's dependency plugins' API.
+
+Some calls, such as 'registration' APIs exposed from dependency plugins, should be checked,
+to ensure both that they are actually executed, and performed with the correct parameters.
+
+For our example plugin's `SuggestionsService`, we should assert that the suggestion provider is correctly 
+registered to the `data` plugin during the `setup` phase, and that `getSuggestions` calls 
+`autocomplete.getQuerySuggestions` with the correct parameters.
+
+```typescript
+// src/plugins/myplugin/public/suggestions/suggestion_service.test.ts
+import {
+  dataPluginMock,
+  Setup as DataPluginSetupMock,
+  Start as DataPluginStartMock,
+} from '../../../data/public/mocks';
+import { SuggestionsService } from './suggestion_service';
+
+describe('SuggestionsService', () => {
+  let service: SuggestionsService;
+  let dataSetup: DataPluginSetupMock;
+  let dataStart: DataPluginStartMock;
+
+  beforeEach(() => {
+    service = new SuggestionsService();
+    dataSetup = dataPluginMock.createSetupContract();
+    dataStart = dataPluginMock.createStartContract();
+  });
+
+  describe('#setup', () => {
+    it('registers the query suggestion provider to the data plugin', () => {
+      service.setup(dataSetup);
+
+      expect(dataSetup.autocomplete.addQuerySuggestionProvider).toHaveBeenCalledTimes(1);
+      expect(dataSetup.autocomplete.addQuerySuggestionProvider).toHaveBeenCalledWith(
+        'fr',
+        expect.any(Function)
+      );
+    });
+  });
+
+  describe('#start', () => {
+    describe('#getSuggestions', () => {
+      it('calls getQuerySuggestions with the correct query', async () => {
+        service.setup(dataSetup);
+        const serviceStart = service.start(dataStart);
+
+        await serviceStart.getSuggestions('some query');
+
+        expect(dataStart.autocomplete.getQuerySuggestions).toHaveBeenCalledTimes(1);
+        expect(dataStart.autocomplete.getQuerySuggestions).toHaveBeenCalledWith(
+          expect.objectContaining({
+            query: 'some query',
+          })
+        );
+      });
+    });
+  });
+});
+```
+
+### Testing components consuming the dependencies
+
+When testing parts of your plugin code that depends on the dependency plugin's data, the best approach
+is to mock the dependency to be able to get the behavior expected for the test.
+
+In this example, we are going to mock the results of `autocomplete.getQuerySuggestions` to be able to test 
+the service's `getSuggestions` method.
+
+```typescript
+// src/plugins/myplugin/public/suggestions/suggestion_service.ts
+
+describe('#start', () => {
+  describe('#getSuggestions', () => {
+    it('returns the default suggestions when autocomplete returns no results', async () => {
+      dataStart.autocomplete.getQuerySuggestions.mockResolvedValue([]);
+
+      service.setup(dataSetup);
+      const serviceStart = service.start(dataStart);
+
+      const results = await serviceStart.getSuggestions('some query');
+      expect(results).toEqual(defaultSuggestions);
+    });
+
+    it('excludes conjunctions from the autocomplete results', async () => {
+      dataStart.autocomplete.getQuerySuggestions.mockResolvedValue([
+        {
+          type: 'field',
+          text: 'field suggestion',
+        },
+        {
+          type: 'conjunction',
+          text: 'conjunction suggestion',
+        },
+      ]);
+
+      service.setup(dataSetup);
+      const serviceStart = service.start(dataStart);
+
+      const results = await serviceStart.getSuggestions('some query');
+
+      expect(results).toEqual([
+        {
+          type: 'field',
+          text: 'field suggestion',
+        },
+      ]);
+    });
+  });
+});
+```
+
+### Testing optional plugin dependencies
+
+Plugins should test that their behavior remains correct when their optional dependencies are either available or not.
+
+A basic test would be to ensure that the plugin properly initialize without error when the optional
+dependency is missing:
+
+```typescript
+// src/plugins/myplugin/public/plugin.test.ts
+import { coreMock } from '../../../core/public/mocks';
+import { dataPluginMock } from '../../data/public/mocks';
+import { MyPlugin } from './plugin';
+
+describe('Plugin', () => {
+  it('initializes correctly if usageCollection is disabled', () => {
+    const plugin = new MyPlugin(coreMock.createPluginInitializerContext());
+    const coreSetup = coreMock.createSetup();
+    const setupDeps = {
+      data: dataPluginMock.createSetupContract(),
+      // optional usageCollector dependency is not available
+    };
+  
+    const coreStart = coreMock.createStart();
+    const startDeps = {
+      data: dataPluginMock.createStartContract(),
+    };
+  
+    expect(() => {
+      plugin.setup(coreSetup, setupDeps);
+    }).not.toThrow();
+    expect(() => {
+      plugin.start(coreStart, startDeps);
+    }).not.toThrow();
+  });
+});
+```
+
+Then we should test that when optional dependency is properly used when present:
+
+```typescript
+// src/plugins/myplugin/public/plugin.test.ts
+import { coreMock } from '../../../core/public/mocks';
+import { dataPluginMock } from '../../data/public/mocks';
+import { usageCollectionPluginMock } from '../../usage_collection/public/mocks';
+
+import { METRIC_TYPE } from '@kbn/analytics';
+
+import { MyPlugin } from './plugin';
+
+describe('Plugin', () => {
+  // [...]
+
+  it('enables trackUserAgent when usageCollection is available', async () => {
+    const plugin = new MyPlugin(coreMock.createPluginInitializerContext());
+    const coreSetup = coreMock.createSetup();
+    const usageCollectionSetup = usageCollectionPluginMock.createSetupContract();
+    const setupDeps = {
+      data: dataPluginMock.createSetupContract(),
+      usageCollection: usageCollectionSetup,
+    };
+
+    plugin.setup(coreSetup, setupDeps);
+
+    expect(usageCollectionSetup.reportUiCounter).toHaveBeenCalledTimes(2);
+    expect(usageCollectionSetup.reportUiCounter).toHaveBeenCalledWith('my_plugin', METRIC_TYPE.LOADED, 'my_event');
+  });
+});
+```
+
+## RXJS testing
+
+### Testing RXJS observables with marble
+
+Testing observable based APIs can be challenging, specially when asynchronous operators or sources are used, 
+or when trying to assert against emission's timing.
+
+Fortunately, RXJS comes with it's own `marble` testing module to greatly facilitate that kind of testing.
+
+See [the official doc](https://rxjs-dev.firebaseapp.com/guide/testing/marble-testing) for more information about marble testing.
+
+### Preconditions
+
+The following examples all assume that the following snippet is included in every test file:
+
+```typescript
+import { TestScheduler } from 'rxjs/testing';
+
+const getTestScheduler = () =>
+  new TestScheduler((actual, expected) => {
+    expect(actual).toEqual(expected);
+  });
+```
+
+`getTestScheduler` creates a `TestScheduler` that is wired on `jest`'s `expect` statement when comparing an observable's time frame.
+
+### Examples
+
+#### Testing an interval based observable
+
+Here is a very basic example of an interval-based API:
+
+```typescript
+class FooService {
+  setup() {
+    return {
+      getUpdate$: () => {
+        return interval(100).pipe(map((count) => `update-${count + 1}`));
+      },
+    };
+  }
+}
+```
+
+If we were to be adding a test that asserts the correct behavior of this API without using marble testing, it
+would probably be something like:
+
+```typescript
+it('getUpdate$ emits updates every 100ms', async () => {
+  const service = new FooService();
+  const { getUpdate$ } = service.setup();
+  expect(await getUpdate$().pipe(take(3), toArray()).toPromise()).toEqual([
+    'update-1',
+    'update-2',
+    'update-3',
+  ]);
+});
+```
+
+Note that if we are able to test the correct value of each emission, we don't have any way to assert that
+the interval of 100ms was respected. Even using a subscription based test to try to do so would result
+in potential flakiness, as the subscription execution could trigger on the `101ms` time frame for example.
+
+It also may be important to note:
+- as we need to convert the observable to a promise and wait for the result, the test is `async`
+- we need to perform observable transformation (`take` + `toArray`) in the test to have an usable value to assert against.
+
+Marble testing would allow to get rid of these limitations. An equivalent and improved marble test could be:
+
+```typescript
+  describe('getUpdate$', () => {
+    it('emits updates every 100ms', () => {
+      getTestScheduler().run(({ expectObservable }) => {
+        const { getUpdate$ } = service.setup();
+        expectObservable(getUpdate$(), '301ms !').toBe('100ms a 99ms b 99ms c', {
+          a: 'update-1',
+          b: 'update-2',
+          c: 'update-3',
+        });
+      });
+    });
+  });
+```
+
+Notes:
+- the test is now synchronous
+- the second parameter of `expectObservable` (`'301ms !'`) is used to perform manual unsubscription to the observable, as 
+  `interval` never ends.
+- an emission is considered a time frame, meaning that after the initial `a` emission, we are at the frame `101`, not `100`
+  which is why we are then only using a `99ms` gap between a->b and b->c.
+
+#### Testing observable completion
+
+Let's 'improve' our `getUpdate$` API by allowing the consumer to manually terminate the observable chain using
+a new `abort$` option:
+
+```typescript
+class FooService {
+  setup() {
+    return {
+      // note: using an abortion observable is usually an anti-pattern, as unsubscribing from the observable
+      // is, most of the time, a better solution. This is only used for the example purpose.
+      getUpdate$: ({ abort$ = EMPTY }: { abort$?: Observable<undefined> } = {}) => {
+        return interval(100).pipe(
+            takeUntil(abort$), 
+            map((count) => `update-${count + 1}`)
+        );
+      },
+    };
+  }
+}
+```
+
+We would then add a test to assert than this new option usage is respected:
+
+```typescript
+it('getUpdate$ completes when `abort$` emits', () => {
+  const service = new FooService();
+  getTestScheduler().run(({ expectObservable, hot }) => {
+    const { getUpdate$ } = service.setup();
+    const abort$ = hot('149ms a', { a: undefined });
+    expectObservable(getUpdate$({ abort$ })).toBe('100ms a 48ms |', {
+      a: 'update-1',
+    });
+  });
+});
+```
+
+Notes:
+  - the `|` symbol represents the completion of the observable.
+  - we are here using the `hot` testing utility to create the `abort$` observable to ensure correct emission timing.
+ 
+#### Testing observable errors 
+
+Testing errors thrown by the observable is very close to the previous examples and is done using
+the third parameter of `expectObservable`.
+
+Say we have a service in charge of processing data from an observable and returning the results in a new observable:
+
+```typescript
+interface SomeDataType {
+  id: string;
+}
+
+class BarService {
+  setup() {
+    return {
+      processDataStream: (data$: Observable<SomeDataType>) => {
+        return data$.pipe(
+          map((data) => {
+            if (data.id === 'invalid') {
+              throw new Error(`invalid data: '${data.id}'`);
+            }
+            return {
+              ...data,
+              processed: 'additional-data',
+            };
+          })
+        );
+      },
+    };
+  }
+}
+```
+ 
+We could write a test that asserts the service properly emit processed results until an invalid data is encountered:
+ 
+```typescript
+it('processDataStream throw an error when processing invalid data', () => {
+  getTestScheduler().run(({ expectObservable, hot }) => {
+    const service = new BarService();
+    const { processDataStream } = service.setup();
+
+    const data = hot('--a--b--(c|)', {
+      a: { id: 'a' },
+      b: { id: 'invalid' },
+      c: { id: 'c' },
+    });
+
+    expectObservable(processDataStream(data)).toBe(
+      '--a--#',
+      {
+        a: { id: 'a', processed: 'additional-data' },
+      },
+      `'[Error: invalid data: 'invalid']'`
+    );
+  });
+});
+```
+
+Notes:
+ - the `-` symbol represents one virtual time frame.
+ - the `#` symbol represents an error.
+ - when throwing custom `Error` classes, the assertion can be against an error instance, but this doesn't work
+   with base errors.
+ 
+#### Testing promise based observables
+
+In some cases, the observable we want to test is based on a Promise (like `of(somePromise).pipe(...)`). This can occur
+when using promise-based services, such as core's `http`, for instance.
+
+```typescript
+export const callServerAPI = (
+  http: HttpStart,
+  body: Record<string, any>,
+  { abort$ }: { abort$: Observable<undefined> }
+): Observable<SomeResponse> => {
+  let controller: AbortController | undefined;
+  if (abort$) {
+    controller = new AbortController();
+    abort$.subscribe(() => {
+      controller!.abort();
+    });
+  }
+  return from(
+    http.post<SomeResponse>('/api/endpoint', {
+      body,
+      signal: controller?.signal,
+    })
+  ).pipe(
+    takeUntil(abort$ ?? EMPTY),
+    map((response) => response.results)
+  );
+};
+```
+
+Testing that kind of promise based observable does not work out of the box with marble testing, as the asynchronous promise resolution
+is not handled by the test scheduler's 'sandbox'.
+
+Fortunately, there are workarounds for this problem. The most common one being to mock the promise-returning API to return
+an observable instead for testing, as `of(observable)` also works and returns the input observable. 
+
+Note that when doing so, the test suite must also include tests using a real promise value to ensure correct behavior in real situation.
+
+```typescript
+
+// NOTE: test scheduler do not properly work with promises because of their asynchronous nature.
+// we are cheating here by having `http.post` return an observable instead of a promise.
+// this still allows more finely grained testing about timing, and asserting that the method
+// works properly when `post` returns a real promise is handled in other tests of this suite
+
+it('callServerAPI result observable emits when the response is received', () => {
+  const http = httpServiceMock.createStartContract();
+  getTestScheduler().run(({ expectObservable, hot }) => {
+    // need to cast the observable as `any` because http.post.mockReturnValue expects a promise, see previous comment
+    http.post.mockReturnValue(hot('---(a|)', { a: { someData: 'foo' } }) as any);
+
+    const results = callServerAPI(http, { query: 'term' }, {});
+
+    expectObservable(results).toBe('---(a|)', {
+      a: { someData: 'foo' },
+    });
+  });
+});
+
+it('completes without returning results if aborted$ emits before the response', () => {
+  const http = httpServiceMock.createStartContract();
+  getTestScheduler().run(({ expectObservable, hot }) => {
+    // need to cast the observable as `any` because http.post.mockReturnValue expects a promise, see previous comment
+    http.post.mockReturnValue(hot('---(a|)', { a: { someData: 'foo' } }) as any);
+    const aborted$ = hot('-(a|)', { a: undefined });
+    const results = callServerAPI(http, { query: 'term' }, { aborted$ });
+
+    expectObservable(results).toBe('-|');
+  });
+});
+```
\ No newline at end of file
diff --git a/docs/CHANGELOG.asciidoc b/docs/CHANGELOG.asciidoc
index 9be0170b67b741..b2ce650a531dca 100644
--- a/docs/CHANGELOG.asciidoc
+++ b/docs/CHANGELOG.asciidoc
@@ -72,10 +72,10 @@ You must migrate your time_based index patterns to a wildcard pattern. For examp
 [%collapsible]
 ====
 *Details* +
-For the `.tar.gz` and `.zip` archives, `platform` has been removed from the `root` folder name. For more information, refer to {kibana-pull}93835[#93835]
+After you extract an archive, the output directory no longer includes the target platform. For example, `kibana-8.0.0-linux-aarch64.tar.gz` produces a `kibana-8.0.0` folder. For more information, refer to {kibana-pull}93835[#93835].
 
 *Impact* +
-The `root` folder name now appears as `kibana-8.0.0-SNAPSHOT-linux-aarch64.tar.gz -> kibana-8.0.0-SNAPSHOT`.
+To use the new folder, update the configuration management tools and automation.
 ====
       
 [discrete]
@@ -84,10 +84,10 @@ The `root` folder name now appears as `kibana-8.0.0-SNAPSHOT-linux-aarch64.tar.g
 [%collapsible]
 ====
 *Details* +
-The default support for TLS v1.0 and v1.1 has been removed. For more information, refer to {kibana-pull}90511[#90511]
+The default support for TLS v1.0 and v1.1 has been removed. For more information, refer to {kibana-pull}90511[#90511].
 
 *Impact* +
-To enable support, set the environment variable to `NODE_OPTIONS=--tls-min-1.0`.
+To enable support, set `--tls-min-1.0` in the `node.options` configuration file. To locate the configuration file, go to the kibana/config folder or any other configuration with the `KBN_PATH_CONF` environment variable. For example, if you are using a Debian-based system, the configuration file is located in /etc/kibana.
 ====
            
 [discrete]
@@ -96,10 +96,10 @@ To enable support, set the environment variable to `NODE_OPTIONS=--tls-min-1.0`.
 [%collapsible]
 ====
 *Details* +
-Systems that don't have `service` aliased to use kibana.service are unable to use `service start kibana`. For more information, refer to {kibana-pull}74424[#74424]
+All supported operating systems use systemd service files. Any system that doesn’t have `service` aliased to use kibana.service should use `systemctl start kibana.service` instead of `service start kibana`. For more information, refer to {kibana-pull}74424[#74424].
 
 *Impact* +
-If your system doesn't have `service` aliased to use kibana.service, use `systemctl start kibana.service`.
+If your installation uses .deb or .rpm packages with SysV, migrate to systemd.
 ====
        
 [discrete]
@@ -108,10 +108,30 @@ If your system doesn't have `service` aliased to use kibana.service, use `system
 [%collapsible]
 ====
 *Details* +
-By default, responses are not logged. Previously, responses were logged if `logging.json` was set to `true`, `logging.dest` was specified, or a TTY was detected. For more information, refer to {kibana-pull}42353[#42353]
+In previous versions, all events are logged in `json` when `logging.json:true`. With the new logging configuration, you can choose the `json` and pattern output formats with layouts. For more information, refer to {kibana-pull}42353[#42353].
 
 *Impact* +
-To log responses, set `logging.events.response=*` in kibana.yml.
+To restore the previous behavior, configure the logging format for each custom appender with the `appender.layout property` in kibana.yml. There is no default for custom appenders, and each appender must be configured expilictly.
+
+[source,yaml]
+-------------------
+logging:
+  appenders:
+    custom_console:
+      type: console
+      layout:
+        type: pattern
+    custom_json:
+      type: console
+      layout:
+        type: json
+  loggers:
+    - name: plugins.myPlugin
+      appenders: [custom_console]
+  root:
+    appenders: [default, custom_json]
+    level: warn
+-------------------
 ====
 
 [float]
@@ -120,7 +140,7 @@ To log responses, set `logging.events.response=*` in kibana.yml.
       
 [discrete]
 [[breaking-52539]]
-.Removed legacy Reporting job params compatibility shim
+.Legacy job parameters are no longer supported
 [%collapsible]
 ====
 *Details* +
@@ -152,10 +172,10 @@ Use the `/api/security/saml/callback` route, or wait to upgrade to 8.0.0-alpha2
 [%collapsible]
 ====
 *Details* +
-To provide the maximum level of protection for most installations, the csp.strict config is now enabled by default. Legacy browsers not supported by Kibana, such as IE11, are unable to access {kib} unless explicitly enabled. All browsers officially supported by Kibana do not have this issue. For more information, refer to {kibana-pull}41700[#41700]
+To provide the maximum level of protection for most installations, the csp.strict config is now enabled by default. Legacy browsers not supported by Kibana, such as Internet Explorer 11, are unable to access {kib} unless explicitly enabled. All browsers officially supported by Kibana do not have this issue. For more information, refer to {kibana-pull}41700[#41700]
 
 *Impact* +
-To enable support for legacy browsers, set `csp.strict: false` in kibana.yml.
+To enable support for legacy browsers, set `csp.strict: false` in kibana.yml. To effectively enforce the security protocol, we strongly discourage disabling `csp.strict` unless it is critical that you support Internet Explorer 11.
 ====
 
 [float]
@@ -191,14 +211,14 @@ You are now unable to use `0` as the `server.host`.
 
 [discrete]
 [[breaking-38657]]
-.Removed `xpack.security.authProviders` and `xpack.security.public`
+.Removed `xpack.security.public` and `xpack.security.authProviders`
 [%collapsible]
 ====
 *Details* +
 The `xpack.security.public` and `xpack.security.authProviders` settings have been removed. For more information, refer to {kibana-pull}38657[#38657]
 
 *Impact* +
-Use the `xpack.security.authc.saml.realm` setting.
+Use the `xpack.security.authc.saml.realm` and `xpack.security.authc.providers` settings.
 ====
 
 [discrete]
diff --git a/docs/developer/contributing/linting.asciidoc b/docs/developer/contributing/linting.asciidoc
index 0d05afa5045381..eb7c22c517e4b1 100644
--- a/docs/developer/contributing/linting.asciidoc
+++ b/docs/developer/contributing/linting.asciidoc
@@ -47,17 +47,21 @@ file types.
 "eslint.validate": [
   "javascript",
   "javascriptreact",
-  { "language": "typescript", "autoFix": true },
-  { "language": "typescriptreact", "autoFix": true }
+  "typescript",
+  "typescriptreact",
 ]
 ----
 
+Although, starting with https://github.com/microsoft/vscode-eslint#version-204[ESLint v2.0.4], there is no need to use `eslint.validate` to parse typescript files as it works out of the box.
+
 `eslint` can automatically fix trivial lint errors when you save a
 file by adding this line in your setting.
 
 [source,json]
 ----
-  "eslint.autoFixOnSave": true,
+"editor.codeActionsOnSave": {
+   "source.fixAll.eslint": true
+}
 ----
 
 :warning: It is *not* recommended to use the
@@ -67,4 +71,4 @@ the multiple `.eslintrc.js` files across the project and some of them
 use the https://www.npmjs.com/package/prettier[NPM version of Prettier].
 Using the IDE extension might cause conflicts, applying the formatting
 to too many files that shouldn’t be prettier-ized and/or highlighting
-errors that are actually OK.
\ No newline at end of file
+errors that are actually OK.
diff --git a/docs/developer/plugin-list.asciidoc b/docs/developer/plugin-list.asciidoc
index eaaab3386a7951..dc410f2e5f2a56 100644
--- a/docs/developer/plugin-list.asciidoc
+++ b/docs/developer/plugin-list.asciidoc
@@ -115,10 +115,18 @@ for use in their own application.
 |Expression Shape plugin adds a shape function to the expression plugin and an associated renderer. The renderer will display the given shape with selected decorations.
 
 
+|{kib-repo}blob/{branch}/src/plugins/field_formats/README.md[fieldFormats]
+|Index pattern fields formatters
+
+
 |{kib-repo}blob/{branch}/src/plugins/home/README.md[home]
 |Moves the legacy ui/registry/feature_catalogue module for registering "features" that should be shown in the home page's feature catalogue to a service within a "home" plugin. The feature catalogue refered to here should not be confused with the "feature" plugin for registering features used to derive UI capabilities for feature controls.
 
 
+|{kib-repo}blob/{branch}/src/plugins/index_pattern_editor/README.md[indexPatternEditor]
+|Create index patterns from within Kibana apps.
+
+
 |{kib-repo}blob/{branch}/src/plugins/index_pattern_field_editor/README.md[indexPatternFieldEditor]
 |The reusable field editor across Kibana!
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.overlayflyoutopenoptions.hideclosebutton.md b/docs/development/core/public/kibana-plugin-core-public.overlayflyoutopenoptions.hideclosebutton.md
new file mode 100644
index 00000000000000..149a53f35d34d4
--- /dev/null
+++ b/docs/development/core/public/kibana-plugin-core-public.overlayflyoutopenoptions.hideclosebutton.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [OverlayFlyoutOpenOptions](./kibana-plugin-core-public.overlayflyoutopenoptions.md) &gt; [hideCloseButton](./kibana-plugin-core-public.overlayflyoutopenoptions.hideclosebutton.md)
+
+## OverlayFlyoutOpenOptions.hideCloseButton property
+
+<b>Signature:</b>
+
+```typescript
+hideCloseButton?: boolean;
+```
diff --git a/docs/development/core/public/kibana-plugin-core-public.overlayflyoutopenoptions.md b/docs/development/core/public/kibana-plugin-core-public.overlayflyoutopenoptions.md
index 6665ebde295bc5..fc4959b87a9877 100644
--- a/docs/development/core/public/kibana-plugin-core-public.overlayflyoutopenoptions.md
+++ b/docs/development/core/public/kibana-plugin-core-public.overlayflyoutopenoptions.md
@@ -18,6 +18,7 @@ export interface OverlayFlyoutOpenOptions
 |  ["data-test-subj"](./kibana-plugin-core-public.overlayflyoutopenoptions._data-test-subj_.md) | <code>string</code> |  |
 |  [className](./kibana-plugin-core-public.overlayflyoutopenoptions.classname.md) | <code>string</code> |  |
 |  [closeButtonAriaLabel](./kibana-plugin-core-public.overlayflyoutopenoptions.closebuttonarialabel.md) | <code>string</code> |  |
+|  [hideCloseButton](./kibana-plugin-core-public.overlayflyoutopenoptions.hideclosebutton.md) | <code>boolean</code> |  |
 |  [maxWidth](./kibana-plugin-core-public.overlayflyoutopenoptions.maxwidth.md) | <code>boolean &#124; number &#124; string</code> |  |
 |  [ownFocus](./kibana-plugin-core-public.overlayflyoutopenoptions.ownfocus.md) | <code>boolean</code> |  |
 |  [size](./kibana-plugin-core-public.overlayflyoutopenoptions.size.md) | <code>EuiFlyoutSize</code> |  |
diff --git a/docs/development/core/server/kibana-plugin-core-server.savedobjectsutils.getconvertedobjectid.md b/docs/development/core/server/kibana-plugin-core-server.savedobjectsutils.getconvertedobjectid.md
new file mode 100644
index 00000000000000..c6a429d345ed1e
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-core-server.savedobjectsutils.getconvertedobjectid.md
@@ -0,0 +1,28 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [SavedObjectsUtils](./kibana-plugin-core-server.savedobjectsutils.md) &gt; [getConvertedObjectId](./kibana-plugin-core-server.savedobjectsutils.getconvertedobjectid.md)
+
+## SavedObjectsUtils.getConvertedObjectId() method
+
+Uses a single-namespace object's "legacy ID" to determine what its new ID will be after it is converted to a multi-namespace type.
+
+<b>Signature:</b>
+
+```typescript
+static getConvertedObjectId(namespace: string | undefined, type: string, id: string): string;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  namespace | <code>string &#124; undefined</code> |  |
+|  type | <code>string</code> |  |
+|  id | <code>string</code> |  |
+
+<b>Returns:</b>
+
+`string`
+
+{<!-- -->string<!-- -->} The ID of the saved object after it is converted.
+
diff --git a/docs/development/core/server/kibana-plugin-core-server.savedobjectsutils.md b/docs/development/core/server/kibana-plugin-core-server.savedobjectsutils.md
index 0148621e757b79..ab6382aca6a52b 100644
--- a/docs/development/core/server/kibana-plugin-core-server.savedobjectsutils.md
+++ b/docs/development/core/server/kibana-plugin-core-server.savedobjectsutils.md
@@ -24,5 +24,6 @@ export declare class SavedObjectsUtils
 |  Method | Modifiers | Description |
 |  --- | --- | --- |
 |  [generateId()](./kibana-plugin-core-server.savedobjectsutils.generateid.md) | <code>static</code> | Generates a random ID for a saved objects. |
+|  [getConvertedObjectId(namespace, type, id)](./kibana-plugin-core-server.savedobjectsutils.getconvertedobjectid.md) | <code>static</code> | Uses a single-namespace object's "legacy ID" to determine what its new ID will be after it is converted to a multi-namespace type. |
 |  [isRandomId(id)](./kibana-plugin-core-server.savedobjectsutils.israndomid.md) | <code>static</code> | Validates that a saved object ID has been randomly generated. |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.tojson.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.tojson.md
index 6e9f12d98d1491..2c93ae6143b445 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.tojson.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfig.tojson.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Use serialize() instead.  8.0
+> Use serialize() instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigserialized.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigserialized.md
new file mode 100644
index 00000000000000..9660a15d94a69c
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigserialized.md
@@ -0,0 +1,19 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigSerialized](./kibana-plugin-plugins-data-public.aggconfigserialized.md)
+
+## AggConfigSerialized type
+
+\*
+
+<b>Signature:</b>
+
+```typescript
+export declare type AggConfigSerialized = Ensure<{
+    type: string;
+    enabled?: boolean;
+    id?: string;
+    params?: {} | SerializableState;
+    schema?: string;
+}, SerializableState>;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternaggrestrictions.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggregationrestrictions.md
similarity index 69%
rename from docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternaggrestrictions.md
rename to docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggregationrestrictions.md
index 324bd1e410c6ca..b3d04027980ca9 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatternaggrestrictions.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggregationrestrictions.md
@@ -1,8 +1,8 @@
 <!-- Do not edit this file. It is automatically generated by API Documenter. -->
 
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IndexPatternAggRestrictions](./kibana-plugin-plugins-data-public.indexpatternaggrestrictions.md)
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggregationRestrictions](./kibana-plugin-plugins-data-public.aggregationrestrictions.md)
 
-## IndexPatternAggRestrictions type
+## AggregationRestrictions type
 
 <b>Signature:</b>
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.baseformatterspublic.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.baseformatterspublic.md
deleted file mode 100644
index 1aa9f460c4fac8..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.baseformatterspublic.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [baseFormattersPublic](./kibana-plugin-plugins-data-public.baseformatterspublic.md)
-
-## baseFormattersPublic variable
-
-<b>Signature:</b>
-
-```typescript
-baseFormattersPublic: (import("../../common").FieldFormatInstanceType | typeof DateFormat | typeof DateNanosFormat)[]
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.castestokbnfieldtypename.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.castestokbnfieldtypename.md
index c6135d9313b237..90aa0b0a8a3134 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.castestokbnfieldtypename.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.castestokbnfieldtypename.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import from the "<!-- -->@<!-- -->kbn/field-types" package directly instead.  8.0
+> Import from the "<!-- -->@<!-- -->kbn/field-types" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.customfilter.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.customfilter.md
index 3d08df8544d6ca..6addd931ce22d7 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.customfilter.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.customfilter.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.0
+> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.dataplugin.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.dataplugin.md
index 4b2cad7b428821..b970a408e51302 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.dataplugin.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.dataplugin.md
@@ -20,7 +20,7 @@ export declare class DataPublicPlugin implements Plugin<DataPublicPluginSetup, D
 
 |  Method | Modifiers | Description |
 |  --- | --- | --- |
-|  [setup(core, { bfetch, expressions, uiActions, usageCollection, inspector })](./kibana-plugin-plugins-data-public.dataplugin.setup.md) |  |  |
-|  [start(core, { uiActions })](./kibana-plugin-plugins-data-public.dataplugin.start.md) |  |  |
+|  [setup(core, { bfetch, expressions, uiActions, usageCollection, inspector, fieldFormats, })](./kibana-plugin-plugins-data-public.dataplugin.setup.md) |  |  |
+|  [start(core, { uiActions, fieldFormats })](./kibana-plugin-plugins-data-public.dataplugin.start.md) |  |  |
 |  [stop()](./kibana-plugin-plugins-data-public.dataplugin.stop.md) |  |  |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.dataplugin.setup.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.dataplugin.setup.md
index ab1f90c1ac1049..3c9a3e5c0751f1 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.dataplugin.setup.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.dataplugin.setup.md
@@ -7,7 +7,7 @@
 <b>Signature:</b>
 
 ```typescript
-setup(core: CoreSetup<DataStartDependencies, DataPublicPluginStart>, { bfetch, expressions, uiActions, usageCollection, inspector }: DataSetupDependencies): DataPublicPluginSetup;
+setup(core: CoreSetup<DataStartDependencies, DataPublicPluginStart>, { bfetch, expressions, uiActions, usageCollection, inspector, fieldFormats, }: DataSetupDependencies): DataPublicPluginSetup;
 ```
 
 ## Parameters
@@ -15,7 +15,7 @@ setup(core: CoreSetup<DataStartDependencies, DataPublicPluginStart>, { bfetch, e
 |  Parameter | Type | Description |
 |  --- | --- | --- |
 |  core | <code>CoreSetup&lt;DataStartDependencies, DataPublicPluginStart&gt;</code> |  |
-|  { bfetch, expressions, uiActions, usageCollection, inspector } | <code>DataSetupDependencies</code> |  |
+|  { bfetch, expressions, uiActions, usageCollection, inspector, fieldFormats, } | <code>DataSetupDependencies</code> |  |
 
 <b>Returns:</b>
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.dataplugin.start.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.dataplugin.start.md
index 4ea7ec8cd4f65f..c7611ac761bb9d 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.dataplugin.start.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.dataplugin.start.md
@@ -7,7 +7,7 @@
 <b>Signature:</b>
 
 ```typescript
-start(core: CoreStart, { uiActions }: DataStartDependencies): DataPublicPluginStart;
+start(core: CoreStart, { uiActions, fieldFormats }: DataStartDependencies): DataPublicPluginStart;
 ```
 
 ## Parameters
@@ -15,7 +15,7 @@ start(core: CoreStart, { uiActions }: DataStartDependencies): DataPublicPluginSt
 |  Parameter | Type | Description |
 |  --- | --- | --- |
 |  core | <code>CoreStart</code> |  |
-|  { uiActions } | <code>DataStartDependencies</code> |  |
+|  { uiActions, fieldFormats } | <code>DataStartDependencies</code> |  |
 
 <b>Returns:</b>
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginsetup.fieldformats.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginsetup.fieldformats.md
index 993634023c20c2..54e64c309351ec 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginsetup.fieldformats.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginsetup.fieldformats.md
@@ -4,6 +4,11 @@
 
 ## DataPublicPluginSetup.fieldFormats property
 
+> Warning: This API is now obsolete.
+> 
+> Use fieldFormats plugin instead
+> 
+
 <b>Signature:</b>
 
 ```typescript
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.fieldformats.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.fieldformats.md
index 344044b38f7de9..a60e631835ea49 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.fieldformats.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.fieldformats.md
@@ -4,7 +4,10 @@
 
 ## DataPublicPluginStart.fieldFormats property
 
-field formats service [FieldFormatsStart](./kibana-plugin-plugins-data-public.fieldformatsstart.md)
+> Warning: This API is now obsolete.
+> 
+> Use fieldFormats plugin instead
+> 
 
 <b>Signature:</b>
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.md
index c7810b18c55a9e..341ec0d7e514c0 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.datapublicpluginstart.md
@@ -18,7 +18,7 @@ export interface DataPublicPluginStart
 |  --- | --- | --- |
 |  [actions](./kibana-plugin-plugins-data-public.datapublicpluginstart.actions.md) | <code>DataPublicPluginStartActions</code> | filter creation utilities [DataPublicPluginStartActions](./kibana-plugin-plugins-data-public.datapublicpluginstartactions.md) |
 |  [autocomplete](./kibana-plugin-plugins-data-public.datapublicpluginstart.autocomplete.md) | <code>AutocompleteStart</code> | autocomplete service [AutocompleteStart](./kibana-plugin-plugins-data-public.autocompletestart.md) |
-|  [fieldFormats](./kibana-plugin-plugins-data-public.datapublicpluginstart.fieldformats.md) | <code>FieldFormatsStart</code> | field formats service [FieldFormatsStart](./kibana-plugin-plugins-data-public.fieldformatsstart.md) |
+|  [fieldFormats](./kibana-plugin-plugins-data-public.datapublicpluginstart.fieldformats.md) | <code>FieldFormatsStart</code> |  |
 |  [indexPatterns](./kibana-plugin-plugins-data-public.datapublicpluginstart.indexpatterns.md) | <code>IndexPatternsContract</code> | index patterns service [IndexPatternsContract](./kibana-plugin-plugins-data-public.indexpatternscontract.md) |
 |  [nowProvider](./kibana-plugin-plugins-data-public.datapublicpluginstart.nowprovider.md) | <code>NowProviderPublicContract</code> |  |
 |  [query](./kibana-plugin-plugins-data-public.datapublicpluginstart.query.md) | <code>QueryStart</code> | query service [QueryStart](./kibana-plugin-plugins-data-public.querystart.md) |
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esdslexpressionfunctiondefinition.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esdslexpressionfunctiondefinition.md
deleted file mode 100644
index 0bd00e937eaaaf..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esdslexpressionfunctiondefinition.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [EsdslExpressionFunctionDefinition](./kibana-plugin-plugins-data-public.esdslexpressionfunctiondefinition.md)
-
-## EsdslExpressionFunctionDefinition type
-
-<b>Signature:</b>
-
-```typescript
-export declare type EsdslExpressionFunctionDefinition = ExpressionFunctionDefinition<typeof name, Input, Arguments, Output>;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esfilters.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esfilters.md
index 24d60613d913aa..b5d5c5cfee5ada 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esfilters.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esfilters.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import helpers from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.0
+> Import helpers from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
 > 
 
 Filter helpers namespace:
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.eskuery.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.eskuery.md
index e569733f15e7f7..3b768404aab952 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.eskuery.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.eskuery.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import helpers from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.0
+> Import helpers from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esquery.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esquery.md
index 447e387f90eb5f..2a26b009d74476 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esquery.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esquery.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import helpers from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.0
+> Import helpers from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esqueryconfig.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esqueryconfig.md
index f877fa26b1b253..48a32cd9abe612 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esqueryconfig.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esqueryconfig.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.0
+> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esrawresponseexpressiontypedefinition.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esrawresponseexpressiontypedefinition.md
deleted file mode 100644
index b95ae3c69bf206..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.esrawresponseexpressiontypedefinition.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [EsRawResponseExpressionTypeDefinition](./kibana-plugin-plugins-data-public.esrawresponseexpressiontypedefinition.md)
-
-## EsRawResponseExpressionTypeDefinition type
-
-<b>Signature:</b>
-
-```typescript
-export declare type EsRawResponseExpressionTypeDefinition = ExpressionTypeDefinition<typeof name, EsRawResponse, EsRawResponse>;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.existsfilter.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.existsfilter.md
index 5c98ba4131ac35..79c92cfe52dd71 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.existsfilter.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.existsfilter.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.0
+> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat._constructor_.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat._constructor_.md
deleted file mode 100644
index e38da6600696c9..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat._constructor_.md
+++ /dev/null
@@ -1,21 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [(constructor)](./kibana-plugin-plugins-data-public.fieldformat._constructor_.md)
-
-## FieldFormat.(constructor)
-
-Constructs a new instance of the `FieldFormat` class
-
-<b>Signature:</b>
-
-```typescript
-constructor(_params?: IFieldFormatMetaParams, getConfig?: FieldFormatsGetConfigFn);
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  \_params | <code>IFieldFormatMetaParams</code> |  |
-|  getConfig | <code>FieldFormatsGetConfigFn</code> |  |
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat._params.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat._params.md
deleted file mode 100644
index ac3f256a9afc30..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat._params.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [\_params](./kibana-plugin-plugins-data-public.fieldformat._params.md)
-
-## FieldFormat.\_params property
-
-<b>Signature:</b>
-
-```typescript
-protected readonly _params: any;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.allowsnumericalaggregations.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.allowsnumericalaggregations.md
deleted file mode 100644
index 454a816a601710..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.allowsnumericalaggregations.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [allowsNumericalAggregations](./kibana-plugin-plugins-data-public.fieldformat.allowsnumericalaggregations.md)
-
-## FieldFormat.allowsNumericalAggregations property
-
-<b>Signature:</b>
-
-```typescript
-allowsNumericalAggregations?: boolean;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.convert.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.convert.md
deleted file mode 100644
index 0535585cb4718c..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.convert.md
+++ /dev/null
@@ -1,26 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [convert](./kibana-plugin-plugins-data-public.fieldformat.convert.md)
-
-## FieldFormat.convert() method
-
-Convert a raw value to a formatted string
-
-<b>Signature:</b>
-
-```typescript
-convert(value: any, contentType?: FieldFormatsContentType, options?: HtmlContextTypeOptions | TextContextTypeOptions): string;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  value | <code>any</code> |  |
-|  contentType | <code>FieldFormatsContentType</code> |  |
-|  options | <code>HtmlContextTypeOptions &#124; TextContextTypeOptions</code> |  |
-
-<b>Returns:</b>
-
-`string`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.convertobject.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.convertobject.md
deleted file mode 100644
index 436124ac083871..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.convertobject.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [convertObject](./kibana-plugin-plugins-data-public.fieldformat.convertobject.md)
-
-## FieldFormat.convertObject property
-
- {<!-- -->FieldFormatConvert<!-- -->}  have to remove the private because of https://github.com/Microsoft/TypeScript/issues/17293
-
-<b>Signature:</b>
-
-```typescript
-convertObject: FieldFormatConvert | undefined;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.fieldtype.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.fieldtype.md
deleted file mode 100644
index 1d109a599d2d9c..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.fieldtype.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [fieldType](./kibana-plugin-plugins-data-public.fieldformat.fieldtype.md)
-
-## FieldFormat.fieldType property
-
- {<!-- -->string<!-- -->} - Field Format Type 
-
-<b>Signature:</b>
-
-```typescript
-static fieldType: string | string[];
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.from.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.from.md
deleted file mode 100644
index ec497de59d2368..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.from.md
+++ /dev/null
@@ -1,22 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [from](./kibana-plugin-plugins-data-public.fieldformat.from.md)
-
-## FieldFormat.from() method
-
-<b>Signature:</b>
-
-```typescript
-static from(convertFn: FieldFormatConvertFunction): FieldFormatInstanceType;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  convertFn | <code>FieldFormatConvertFunction</code> |  |
-
-<b>Returns:</b>
-
-`FieldFormatInstanceType`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.getconfig.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.getconfig.md
deleted file mode 100644
index 446e0c237ce132..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.getconfig.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [getConfig](./kibana-plugin-plugins-data-public.fieldformat.getconfig.md)
-
-## FieldFormat.getConfig property
-
-<b>Signature:</b>
-
-```typescript
-protected getConfig: FieldFormatsGetConfigFn | undefined;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.getconverterfor.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.getconverterfor.md
deleted file mode 100644
index f4eeb5eed06a09..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.getconverterfor.md
+++ /dev/null
@@ -1,24 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [getConverterFor](./kibana-plugin-plugins-data-public.fieldformat.getconverterfor.md)
-
-## FieldFormat.getConverterFor() method
-
-Get a convert function that is bound to a specific contentType
-
-<b>Signature:</b>
-
-```typescript
-getConverterFor(contentType?: FieldFormatsContentType): FieldFormatConvertFunction;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  contentType | <code>FieldFormatsContentType</code> |  |
-
-<b>Returns:</b>
-
-`FieldFormatConvertFunction`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.getparamdefaults.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.getparamdefaults.md
deleted file mode 100644
index 59afdc25df350a..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.getparamdefaults.md
+++ /dev/null
@@ -1,17 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [getParamDefaults](./kibana-plugin-plugins-data-public.fieldformat.getparamdefaults.md)
-
-## FieldFormat.getParamDefaults() method
-
-Get parameter defaults  {<!-- -->object<!-- -->} - parameter defaults
-
-<b>Signature:</b>
-
-```typescript
-getParamDefaults(): Record<string, any>;
-```
-<b>Returns:</b>
-
-`Record<string, any>`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.hidden.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.hidden.md
deleted file mode 100644
index 2032f0fc01112f..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.hidden.md
+++ /dev/null
@@ -1,15 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [hidden](./kibana-plugin-plugins-data-public.fieldformat.hidden.md)
-
-## FieldFormat.hidden property
-
-Hidden field formats can only be accessed directly by id, They won't appear in field format editor UI, But they can be accessed and used from code internally.
-
- {<!-- -->boolean<!-- -->} - Is this a hidden field format 
-
-<b>Signature:</b>
-
-```typescript
-static hidden: boolean;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.htmlconvert.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.htmlconvert.md
deleted file mode 100644
index 945ac7ededff64..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.htmlconvert.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [htmlConvert](./kibana-plugin-plugins-data-public.fieldformat.htmlconvert.md)
-
-## FieldFormat.htmlConvert property
-
- {<!-- -->htmlConvert<!-- -->}  have to remove the protected because of https://github.com/Microsoft/TypeScript/issues/17293
-
-<b>Signature:</b>
-
-```typescript
-htmlConvert: HtmlContextTypeConvert | undefined;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.id.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.id.md
deleted file mode 100644
index 91c3ff4f2d9a30..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.id.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [id](./kibana-plugin-plugins-data-public.fieldformat.id.md)
-
-## FieldFormat.id property
-
- {<!-- -->string<!-- -->} - Field Format Id 
-
-<b>Signature:</b>
-
-```typescript
-static id: string;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.isinstanceoffieldformat.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.isinstanceoffieldformat.md
deleted file mode 100644
index c6afa27fe59528..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.isinstanceoffieldformat.md
+++ /dev/null
@@ -1,22 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [isInstanceOfFieldFormat](./kibana-plugin-plugins-data-public.fieldformat.isinstanceoffieldformat.md)
-
-## FieldFormat.isInstanceOfFieldFormat() method
-
-<b>Signature:</b>
-
-```typescript
-static isInstanceOfFieldFormat(fieldFormat: any): fieldFormat is FieldFormat;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  fieldFormat | <code>any</code> |  |
-
-<b>Returns:</b>
-
-`fieldFormat is FieldFormat`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.md
deleted file mode 100644
index 640064af4be126..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.md
+++ /dev/null
@@ -1,48 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md)
-
-## FieldFormat class
-
-<b>Signature:</b>
-
-```typescript
-export declare abstract class FieldFormat 
-```
-
-## Constructors
-
-|  Constructor | Modifiers | Description |
-|  --- | --- | --- |
-|  [(constructor)(\_params, getConfig)](./kibana-plugin-plugins-data-public.fieldformat._constructor_.md) |  | Constructs a new instance of the <code>FieldFormat</code> class |
-
-## Properties
-
-|  Property | Modifiers | Type | Description |
-|  --- | --- | --- | --- |
-|  [\_params](./kibana-plugin-plugins-data-public.fieldformat._params.md) |  | <code>any</code> |  |
-|  [allowsNumericalAggregations](./kibana-plugin-plugins-data-public.fieldformat.allowsnumericalaggregations.md) |  | <code>boolean</code> |  |
-|  [convertObject](./kibana-plugin-plugins-data-public.fieldformat.convertobject.md) |  | <code>FieldFormatConvert &#124; undefined</code> |  {<!-- -->FieldFormatConvert<!-- -->}  have to remove the private because of https://github.com/Microsoft/TypeScript/issues/17293 |
-|  [fieldType](./kibana-plugin-plugins-data-public.fieldformat.fieldtype.md) | <code>static</code> | <code>string &#124; string[]</code> |  {<!-- -->string<!-- -->} - Field Format Type  |
-|  [getConfig](./kibana-plugin-plugins-data-public.fieldformat.getconfig.md) |  | <code>FieldFormatsGetConfigFn &#124; undefined</code> |  |
-|  [hidden](./kibana-plugin-plugins-data-public.fieldformat.hidden.md) | <code>static</code> | <code>boolean</code> | Hidden field formats can only be accessed directly by id, They won't appear in field format editor UI, But they can be accessed and used from code internally. {<!-- -->boolean<!-- -->} - Is this a hidden field format  |
-|  [htmlConvert](./kibana-plugin-plugins-data-public.fieldformat.htmlconvert.md) |  | <code>HtmlContextTypeConvert &#124; undefined</code> |  {<!-- -->htmlConvert<!-- -->}  have to remove the protected because of https://github.com/Microsoft/TypeScript/issues/17293 |
-|  [id](./kibana-plugin-plugins-data-public.fieldformat.id.md) | <code>static</code> | <code>string</code> |  {<!-- -->string<!-- -->} - Field Format Id  |
-|  [textConvert](./kibana-plugin-plugins-data-public.fieldformat.textconvert.md) |  | <code>TextContextTypeConvert &#124; undefined</code> |  {<!-- -->textConvert<!-- -->}  have to remove the protected because of https://github.com/Microsoft/TypeScript/issues/17293 |
-|  [title](./kibana-plugin-plugins-data-public.fieldformat.title.md) | <code>static</code> | <code>string</code> |  {<!-- -->string<!-- -->} - Field Format Title  |
-|  [type](./kibana-plugin-plugins-data-public.fieldformat.type.md) |  | <code>any</code> |  {<!-- -->Function<!-- -->} - ref to child class  |
-
-## Methods
-
-|  Method | Modifiers | Description |
-|  --- | --- | --- |
-|  [convert(value, contentType, options)](./kibana-plugin-plugins-data-public.fieldformat.convert.md) |  | Convert a raw value to a formatted string |
-|  [from(convertFn)](./kibana-plugin-plugins-data-public.fieldformat.from.md) | <code>static</code> |  |
-|  [getConverterFor(contentType)](./kibana-plugin-plugins-data-public.fieldformat.getconverterfor.md) |  | Get a convert function that is bound to a specific contentType |
-|  [getParamDefaults()](./kibana-plugin-plugins-data-public.fieldformat.getparamdefaults.md) |  | Get parameter defaults  {<!-- -->object<!-- -->} - parameter defaults |
-|  [isInstanceOfFieldFormat(fieldFormat)](./kibana-plugin-plugins-data-public.fieldformat.isinstanceoffieldformat.md) | <code>static</code> |  |
-|  [param(name)](./kibana-plugin-plugins-data-public.fieldformat.param.md) |  | Get the value of a param. This value may be a default value. |
-|  [params()](./kibana-plugin-plugins-data-public.fieldformat.params.md) |  | Get all of the params in a single object  {<!-- -->object<!-- -->} |
-|  [setupContentType()](./kibana-plugin-plugins-data-public.fieldformat.setupcontenttype.md) |  |  |
-|  [toJSON()](./kibana-plugin-plugins-data-public.fieldformat.tojson.md) |  | Serialize this format to a simple POJO, with only the params that are not default {<!-- -->object<!-- -->} |
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.param.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.param.md
deleted file mode 100644
index 1e7fd9d161429b..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.param.md
+++ /dev/null
@@ -1,24 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [param](./kibana-plugin-plugins-data-public.fieldformat.param.md)
-
-## FieldFormat.param() method
-
-Get the value of a param. This value may be a default value.
-
-<b>Signature:</b>
-
-```typescript
-param(name: string): any;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  name | <code>string</code> |  |
-
-<b>Returns:</b>
-
-`any`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.params.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.params.md
deleted file mode 100644
index 5825af4925d066..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.params.md
+++ /dev/null
@@ -1,17 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [params](./kibana-plugin-plugins-data-public.fieldformat.params.md)
-
-## FieldFormat.params() method
-
-Get all of the params in a single object  {<!-- -->object<!-- -->}
-
-<b>Signature:</b>
-
-```typescript
-params(): Record<string, any>;
-```
-<b>Returns:</b>
-
-`Record<string, any>`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.setupcontenttype.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.setupcontenttype.md
deleted file mode 100644
index 41f5f2446f22aa..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.setupcontenttype.md
+++ /dev/null
@@ -1,15 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [setupContentType](./kibana-plugin-plugins-data-public.fieldformat.setupcontenttype.md)
-
-## FieldFormat.setupContentType() method
-
-<b>Signature:</b>
-
-```typescript
-setupContentType(): FieldFormatConvert;
-```
-<b>Returns:</b>
-
-`FieldFormatConvert`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.textconvert.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.textconvert.md
deleted file mode 100644
index 57ccca9136081f..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.textconvert.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [textConvert](./kibana-plugin-plugins-data-public.fieldformat.textconvert.md)
-
-## FieldFormat.textConvert property
-
- {<!-- -->textConvert<!-- -->}  have to remove the protected because of https://github.com/Microsoft/TypeScript/issues/17293
-
-<b>Signature:</b>
-
-```typescript
-textConvert: TextContextTypeConvert | undefined;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.title.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.title.md
deleted file mode 100644
index b19246758f080b..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.title.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [title](./kibana-plugin-plugins-data-public.fieldformat.title.md)
-
-## FieldFormat.title property
-
- {<!-- -->string<!-- -->} - Field Format Title 
-
-<b>Signature:</b>
-
-```typescript
-static title: string;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.tojson.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.tojson.md
deleted file mode 100644
index 48ec9456c56dd8..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.tojson.md
+++ /dev/null
@@ -1,25 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [toJSON](./kibana-plugin-plugins-data-public.fieldformat.tojson.md)
-
-## FieldFormat.toJSON() method
-
-Serialize this format to a simple POJO, with only the params that are not default
-
- {<!-- -->object<!-- -->}
-
-<b>Signature:</b>
-
-```typescript
-toJSON(): {
-        id: any;
-        params: any;
-    };
-```
-<b>Returns:</b>
-
-`{
-        id: any;
-        params: any;
-    }`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.type.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.type.md
deleted file mode 100644
index 394a2e3cc9afbf..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformat.type.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) &gt; [type](./kibana-plugin-plugins-data-public.fieldformat.type.md)
-
-## FieldFormat.type property
-
- {<!-- -->Function<!-- -->} - ref to child class 
-
-<b>Signature:</b>
-
-```typescript
-type: any;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatconfig.es.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatconfig.es.md
deleted file mode 100644
index 82441ee41d80dc..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatconfig.es.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormatConfig](./kibana-plugin-plugins-data-public.fieldformatconfig.md) &gt; [es](./kibana-plugin-plugins-data-public.fieldformatconfig.es.md)
-
-## FieldFormatConfig.es property
-
-<b>Signature:</b>
-
-```typescript
-es?: boolean;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatconfig.id.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatconfig.id.md
deleted file mode 100644
index b179c314a56d3f..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatconfig.id.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormatConfig](./kibana-plugin-plugins-data-public.fieldformatconfig.md) &gt; [id](./kibana-plugin-plugins-data-public.fieldformatconfig.id.md)
-
-## FieldFormatConfig.id property
-
-<b>Signature:</b>
-
-```typescript
-id: FieldFormatId;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatconfig.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatconfig.md
deleted file mode 100644
index f856a3132eccba..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatconfig.md
+++ /dev/null
@@ -1,20 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormatConfig](./kibana-plugin-plugins-data-public.fieldformatconfig.md)
-
-## FieldFormatConfig interface
-
-<b>Signature:</b>
-
-```typescript
-export interface FieldFormatConfig 
-```
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [es](./kibana-plugin-plugins-data-public.fieldformatconfig.es.md) | <code>boolean</code> |  |
-|  [id](./kibana-plugin-plugins-data-public.fieldformatconfig.id.md) | <code>FieldFormatId</code> |  |
-|  [params](./kibana-plugin-plugins-data-public.fieldformatconfig.params.md) | <code>Record&lt;string, any&gt;</code> |  |
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatconfig.params.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatconfig.params.md
deleted file mode 100644
index aad977643ad2fe..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatconfig.params.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormatConfig](./kibana-plugin-plugins-data-public.fieldformatconfig.md) &gt; [params](./kibana-plugin-plugins-data-public.fieldformatconfig.params.md)
-
-## FieldFormatConfig.params property
-
-<b>Signature:</b>
-
-```typescript
-params: Record<string, any>;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatid.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatid.md
deleted file mode 100644
index 9f94d50a2001f7..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatid.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormatId](./kibana-plugin-plugins-data-public.fieldformatid.md)
-
-## FieldFormatId type
-
- id type is needed for creating custom converters.
-
-<b>Signature:</b>
-
-```typescript
-export declare type FieldFormatId = FIELD_FORMAT_IDS | string;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformats.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformats.md
deleted file mode 100644
index 838ea2b5d9f3ad..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformats.md
+++ /dev/null
@@ -1,39 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [fieldFormats](./kibana-plugin-plugins-data-public.fieldformats.md)
-
-## fieldFormats variable
-
-<b>Signature:</b>
-
-```typescript
-fieldFormats: {
-    FieldFormat: typeof FieldFormat;
-    FieldFormatsRegistry: typeof FieldFormatsRegistry;
-    DEFAULT_CONVERTER_COLOR: {
-        range: string;
-        regex: string;
-        text: string;
-        background: string;
-    };
-    HTML_CONTEXT_TYPE: import("../common").FieldFormatsContentType;
-    TEXT_CONTEXT_TYPE: import("../common").FieldFormatsContentType;
-    FIELD_FORMAT_IDS: typeof FIELD_FORMAT_IDS;
-    BoolFormat: typeof BoolFormat;
-    BytesFormat: typeof BytesFormat;
-    ColorFormat: typeof ColorFormat;
-    DateFormat: typeof DateFormat;
-    DateNanosFormat: typeof DateNanosFormat;
-    DurationFormat: typeof DurationFormat;
-    IpFormat: typeof IpFormat;
-    NumberFormat: typeof NumberFormat;
-    PercentFormat: typeof PercentFormat;
-    RelativeDateFormat: typeof RelativeDateFormat;
-    SourceFormat: typeof SourceFormat;
-    StaticLookupFormat: typeof StaticLookupFormat;
-    UrlFormat: typeof UrlFormat;
-    StringFormat: typeof StringFormat;
-    TruncateFormat: typeof TruncateFormat;
-    HistogramFormat: typeof HistogramFormat;
-}
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatscontenttype.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatscontenttype.md
deleted file mode 100644
index 8e89a0262b438e..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatscontenttype.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormatsContentType](./kibana-plugin-plugins-data-public.fieldformatscontenttype.md)
-
-## FieldFormatsContentType type
-
-\*
-
-<b>Signature:</b>
-
-```typescript
-export declare type FieldFormatsContentType = 'html' | 'text';
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatsgetconfigfn.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatsgetconfigfn.md
deleted file mode 100644
index c54e549c42a441..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatsgetconfigfn.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormatsGetConfigFn](./kibana-plugin-plugins-data-public.fieldformatsgetconfigfn.md)
-
-## FieldFormatsGetConfigFn type
-
-<b>Signature:</b>
-
-```typescript
-export declare type FieldFormatsGetConfigFn = GetConfigFn;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatsstart.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatsstart.md
deleted file mode 100644
index ac8ddce6e70160..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.fieldformatsstart.md
+++ /dev/null
@@ -1,14 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [FieldFormatsStart](./kibana-plugin-plugins-data-public.fieldformatsstart.md)
-
-## FieldFormatsStart type
-
-
-<b>Signature:</b>
-
-```typescript
-export declare type FieldFormatsStart = Omit<FieldFormatsRegistry, 'init' | 'register'> & {
-    deserialize: FormatFactory;
-};
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.filter.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.filter.md
index b25d313129634e..247760305db9c3 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.filter.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.filter.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.0
+> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getespreference.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getespreference.md
deleted file mode 100644
index f872c56c168ced..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getespreference.md
+++ /dev/null
@@ -1,23 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [getEsPreference](./kibana-plugin-plugins-data-public.getespreference.md)
-
-## getEsPreference() function
-
-<b>Signature:</b>
-
-```typescript
-export declare function getEsPreference(uiSettings: IUiSettingsClient, sessionId?: string): any;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  uiSettings | <code>IUiSettingsClient</code> |  |
-|  sessionId | <code>string</code> |  |
-
-<b>Returns:</b>
-
-`any`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.allownoindex.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.allownoindex.md
new file mode 100644
index 00000000000000..091fb4d8aaa441
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.allownoindex.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [GetFieldsOptions](./kibana-plugin-plugins-data-public.getfieldsoptions.md) &gt; [allowNoIndex](./kibana-plugin-plugins-data-public.getfieldsoptions.allownoindex.md)
+
+## GetFieldsOptions.allowNoIndex property
+
+<b>Signature:</b>
+
+```typescript
+allowNoIndex?: boolean;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.lookback.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.lookback.md
new file mode 100644
index 00000000000000..0e8c7e34b1fe89
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.lookback.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [GetFieldsOptions](./kibana-plugin-plugins-data-public.getfieldsoptions.md) &gt; [lookBack](./kibana-plugin-plugins-data-public.getfieldsoptions.lookback.md)
+
+## GetFieldsOptions.lookBack property
+
+<b>Signature:</b>
+
+```typescript
+lookBack?: boolean;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.md
new file mode 100644
index 00000000000000..056018174baf67
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.md
@@ -0,0 +1,23 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [GetFieldsOptions](./kibana-plugin-plugins-data-public.getfieldsoptions.md)
+
+## GetFieldsOptions interface
+
+<b>Signature:</b>
+
+```typescript
+export interface GetFieldsOptions 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [allowNoIndex](./kibana-plugin-plugins-data-public.getfieldsoptions.allownoindex.md) | <code>boolean</code> |  |
+|  [lookBack](./kibana-plugin-plugins-data-public.getfieldsoptions.lookback.md) | <code>boolean</code> |  |
+|  [metaFields](./kibana-plugin-plugins-data-public.getfieldsoptions.metafields.md) | <code>string[]</code> |  |
+|  [pattern](./kibana-plugin-plugins-data-public.getfieldsoptions.pattern.md) | <code>string</code> |  |
+|  [rollupIndex](./kibana-plugin-plugins-data-public.getfieldsoptions.rollupindex.md) | <code>string</code> |  |
+|  [type](./kibana-plugin-plugins-data-public.getfieldsoptions.type.md) | <code>string</code> |  |
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.metafields.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.metafields.md
new file mode 100644
index 00000000000000..87c0f9d9bfe5b4
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.metafields.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [GetFieldsOptions](./kibana-plugin-plugins-data-public.getfieldsoptions.md) &gt; [metaFields](./kibana-plugin-plugins-data-public.getfieldsoptions.metafields.md)
+
+## GetFieldsOptions.metaFields property
+
+<b>Signature:</b>
+
+```typescript
+metaFields?: string[];
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.pattern.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.pattern.md
new file mode 100644
index 00000000000000..c6c53b2cf7bc81
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.pattern.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [GetFieldsOptions](./kibana-plugin-plugins-data-public.getfieldsoptions.md) &gt; [pattern](./kibana-plugin-plugins-data-public.getfieldsoptions.pattern.md)
+
+## GetFieldsOptions.pattern property
+
+<b>Signature:</b>
+
+```typescript
+pattern: string;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.rollupindex.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.rollupindex.md
new file mode 100644
index 00000000000000..4711e3bdfce92e
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.rollupindex.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [GetFieldsOptions](./kibana-plugin-plugins-data-public.getfieldsoptions.md) &gt; [rollupIndex](./kibana-plugin-plugins-data-public.getfieldsoptions.rollupindex.md)
+
+## GetFieldsOptions.rollupIndex property
+
+<b>Signature:</b>
+
+```typescript
+rollupIndex?: string;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.type.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.type.md
new file mode 100644
index 00000000000000..cdc4c562b56112
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getfieldsoptions.type.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [GetFieldsOptions](./kibana-plugin-plugins-data-public.getfieldsoptions.md) &gt; [type](./kibana-plugin-plugins-data-public.getfieldsoptions.type.md)
+
+## GetFieldsOptions.type property
+
+<b>Signature:</b>
+
+```typescript
+type?: string;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getkbntypenames.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getkbntypenames.md
index 66effff722f3bd..db741f74f538d1 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getkbntypenames.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.getkbntypenames.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import from the "<!-- -->@<!-- -->kbn/field-types" package directly instead.  8.0
+> Import from the "<!-- -->@<!-- -->kbn/field-types" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldformat.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldformat.md
deleted file mode 100644
index 4fe738ddef5dc2..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldformat.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IFieldFormat](./kibana-plugin-plugins-data-public.ifieldformat.md)
-
-## IFieldFormat type
-
-<b>Signature:</b>
-
-```typescript
-export declare type IFieldFormat = FieldFormat;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldformatsregistry.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldformatsregistry.md
deleted file mode 100644
index 0f83e2bb2d4238..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldformatsregistry.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IFieldFormatsRegistry](./kibana-plugin-plugins-data-public.ifieldformatsregistry.md)
-
-## IFieldFormatsRegistry type
-
-<b>Signature:</b>
-
-```typescript
-declare type IFieldFormatsRegistry = PublicMethodsOf<FieldFormatsRegistry>;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldsubtype.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldsubtype.md
index ec723ddc00e723..8fe65d5a86de1f 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldsubtype.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldsubtype.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.0
+> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.md
index b4b31980926049..6a798c3a4add1e 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ifieldtype.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Use [IndexPatternField](./kibana-plugin-plugins-data-public.indexpatternfield.md)  8.0
+> Use [IndexPatternField](./kibana-plugin-plugins-data-public.indexpatternfield.md)  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.add.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.add.md
deleted file mode 100644
index 0f3469ae9c5505..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.add.md
+++ /dev/null
@@ -1,22 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IIndexPatternFieldList](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.md) &gt; [add](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.add.md)
-
-## IIndexPatternFieldList.add() method
-
-<b>Signature:</b>
-
-```typescript
-add(field: FieldSpec): void;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  field | <code>FieldSpec</code> |  |
-
-<b>Returns:</b>
-
-`void`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.getall.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.getall.md
deleted file mode 100644
index 070e36e303a807..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.getall.md
+++ /dev/null
@@ -1,15 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IIndexPatternFieldList](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.md) &gt; [getAll](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.getall.md)
-
-## IIndexPatternFieldList.getAll() method
-
-<b>Signature:</b>
-
-```typescript
-getAll(): IndexPatternField[];
-```
-<b>Returns:</b>
-
-`IndexPatternField[]`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.getbyname.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.getbyname.md
deleted file mode 100644
index e277df87fe908c..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.getbyname.md
+++ /dev/null
@@ -1,22 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IIndexPatternFieldList](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.md) &gt; [getByName](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.getbyname.md)
-
-## IIndexPatternFieldList.getByName() method
-
-<b>Signature:</b>
-
-```typescript
-getByName(name: IndexPatternField['name']): IndexPatternField | undefined;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  name | <code>IndexPatternField['name']</code> |  |
-
-<b>Returns:</b>
-
-`IndexPatternField | undefined`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.getbytype.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.getbytype.md
deleted file mode 100644
index 9a7b3ab36b0c12..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.getbytype.md
+++ /dev/null
@@ -1,22 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IIndexPatternFieldList](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.md) &gt; [getByType](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.getbytype.md)
-
-## IIndexPatternFieldList.getByType() method
-
-<b>Signature:</b>
-
-```typescript
-getByType(type: IndexPatternField['type']): IndexPatternField[];
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  type | <code>IndexPatternField['type']</code> |  |
-
-<b>Returns:</b>
-
-`IndexPatternField[]`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.md
deleted file mode 100644
index b1e13ffaabd077..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.md
+++ /dev/null
@@ -1,26 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IIndexPatternFieldList](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.md)
-
-## IIndexPatternFieldList interface
-
-<b>Signature:</b>
-
-```typescript
-export interface IIndexPatternFieldList extends Array<IndexPatternField> 
-```
-
-## Methods
-
-|  Method | Description |
-|  --- | --- |
-|  [add(field)](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.add.md) |  |
-|  [getAll()](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.getall.md) |  |
-|  [getByName(name)](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.getbyname.md) |  |
-|  [getByType(type)](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.getbytype.md) |  |
-|  [remove(field)](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.remove.md) |  |
-|  [removeAll()](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.removeall.md) |  |
-|  [replaceAll(specs)](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.replaceall.md) |  |
-|  [toSpec(options)](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.tospec.md) |  |
-|  [update(field)](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.update.md) |  |
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.remove.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.remove.md
deleted file mode 100644
index 3b6bbb0691930c..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.remove.md
+++ /dev/null
@@ -1,22 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IIndexPatternFieldList](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.md) &gt; [remove](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.remove.md)
-
-## IIndexPatternFieldList.remove() method
-
-<b>Signature:</b>
-
-```typescript
-remove(field: IFieldType): void;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  field | <code>IFieldType</code> |  |
-
-<b>Returns:</b>
-
-`void`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.removeall.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.removeall.md
deleted file mode 100644
index 55e7ca98e2637a..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.removeall.md
+++ /dev/null
@@ -1,15 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IIndexPatternFieldList](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.md) &gt; [removeAll](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.removeall.md)
-
-## IIndexPatternFieldList.removeAll() method
-
-<b>Signature:</b>
-
-```typescript
-removeAll(): void;
-```
-<b>Returns:</b>
-
-`void`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.replaceall.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.replaceall.md
deleted file mode 100644
index c7e8cdd578bfe7..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.replaceall.md
+++ /dev/null
@@ -1,22 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IIndexPatternFieldList](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.md) &gt; [replaceAll](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.replaceall.md)
-
-## IIndexPatternFieldList.replaceAll() method
-
-<b>Signature:</b>
-
-```typescript
-replaceAll(specs: FieldSpec[]): void;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  specs | <code>FieldSpec[]</code> |  |
-
-<b>Returns:</b>
-
-`void`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.tospec.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.tospec.md
deleted file mode 100644
index 0fe62f575a927b..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.tospec.md
+++ /dev/null
@@ -1,24 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IIndexPatternFieldList](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.md) &gt; [toSpec](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.tospec.md)
-
-## IIndexPatternFieldList.toSpec() method
-
-<b>Signature:</b>
-
-```typescript
-toSpec(options?: {
-        getFormatterForField?: IndexPattern['getFormatterForField'];
-    }): IndexPatternFieldMap;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  options | <code>{</code><br/><code>        getFormatterForField?: IndexPattern['getFormatterForField'];</code><br/><code>    }</code> |  |
-
-<b>Returns:</b>
-
-`IndexPatternFieldMap`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.update.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.update.md
deleted file mode 100644
index 121ffb65f26a52..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.iindexpatternfieldlist.update.md
+++ /dev/null
@@ -1,22 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IIndexPatternFieldList](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.md) &gt; [update](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.update.md)
-
-## IIndexPatternFieldList.update() method
-
-<b>Signature:</b>
-
-```typescript
-update(field: FieldSpec): void;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  field | <code>FieldSpec</code> |  |
-
-<b>Returns:</b>
-
-`void`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.addscriptedfield.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.addscriptedfield.md
index 3f8048d2913fbe..99caa646c17b00 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.addscriptedfield.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.addscriptedfield.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> use runtime field instead  8.0
+> use runtime field instead  8.1
 > 
 
 Add scripted field to field list
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.getnonscriptedfields.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.getnonscriptedfields.md
index 70a9b624099cba..7a704b917daaf2 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.getnonscriptedfields.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.getnonscriptedfields.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> use runtime field instead  8.0
+> use runtime field instead  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.getscriptedfields.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.getscriptedfields.md
index 517dec992c090e..cd91bdcebce608 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.getscriptedfields.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.getscriptedfields.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> use runtime field instead  8.0
+> use runtime field instead  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.intervalname.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.intervalname.md
index 9d26cf9730f461..774601daf4a87e 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.intervalname.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.intervalname.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Used by time range index patterns  8.0
+> Used by time range index patterns  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.removescriptedfield.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.removescriptedfield.md
index fbd85a7d732300..052ccc2ae97b42 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.removescriptedfield.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpattern.removescriptedfield.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> use runtime field instead  8.0
+> use runtime field instead  8.1
 > 
 
 Remove scripted field from field list
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterns.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterns.md
index 4934672d75f31b..75ae06480a781b 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterns.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterns.md
@@ -17,6 +17,5 @@ indexPatterns: {
     isNestedField: typeof isNestedField;
     validate: typeof validateIndexPattern;
     flattenHitWrapper: typeof flattenHitWrapper;
-    formatHitProvider: typeof formatHitProvider;
 }
 ```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterntypemeta.aggs.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterntypemeta.aggs.md
deleted file mode 100644
index 46cb435fb19bcf..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterntypemeta.aggs.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IndexPatternTypeMeta](./kibana-plugin-plugins-data-public.indexpatterntypemeta.md) &gt; [aggs](./kibana-plugin-plugins-data-public.indexpatterntypemeta.aggs.md)
-
-## IndexPatternTypeMeta.aggs property
-
-<b>Signature:</b>
-
-```typescript
-aggs?: Record<string, AggregationRestrictions>;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterntypemeta.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterntypemeta.md
deleted file mode 100644
index 19a884862d4609..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterntypemeta.md
+++ /dev/null
@@ -1,19 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IndexPatternTypeMeta](./kibana-plugin-plugins-data-public.indexpatterntypemeta.md)
-
-## IndexPatternTypeMeta interface
-
-<b>Signature:</b>
-
-```typescript
-export interface TypeMeta 
-```
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [aggs](./kibana-plugin-plugins-data-public.indexpatterntypemeta.aggs.md) | <code>Record&lt;string, AggregationRestrictions&gt;</code> |  |
-|  [params](./kibana-plugin-plugins-data-public.indexpatterntypemeta.params.md) | <code>{</code><br/><code>        rollup_index: string;</code><br/><code>    }</code> |  |
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterntypemeta.params.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterntypemeta.params.md
deleted file mode 100644
index 12646a39188a07..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.indexpatterntypemeta.params.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IndexPatternTypeMeta](./kibana-plugin-plugins-data-public.indexpatterntypemeta.md) &gt; [params](./kibana-plugin-plugins-data-public.indexpatterntypemeta.params.md)
-
-## IndexPatternTypeMeta.params property
-
-<b>Signature:</b>
-
-```typescript
-params?: {
-        rollup_index: string;
-    };
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.inputtimerange.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.inputtimerange.md
deleted file mode 100644
index 649355a5fffb59..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.inputtimerange.md
+++ /dev/null
@@ -1,14 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [InputTimeRange](./kibana-plugin-plugins-data-public.inputtimerange.md)
-
-## InputTimeRange type
-
-<b>Signature:</b>
-
-```typescript
-export declare type InputTimeRange = TimeRange | {
-    from: Moment;
-    to: Moment;
-};
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isfilter.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isfilter.md
index 8891620ad01efc..39da5c0548da08 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isfilter.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isfilter.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.0
+> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isfilters.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isfilters.md
index 522a1c66bb80e8..047a9861002b52 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isfilters.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.isfilters.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.0
+> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.kuerynode.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.kuerynode.md
index 6c6904d6625c67..73d82c25228bb4 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.kuerynode.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.kuerynode.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.0
+> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.matchallfilter.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.matchallfilter.md
index 35ebdb1473c4ee..51d0f8a139da57 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.matchallfilter.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.matchallfilter.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.0
+> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
index 49c9d1d143e6b6..760f6d86514280 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
@@ -13,16 +13,12 @@
 |  [AggParamType](./kibana-plugin-plugins-data-public.aggparamtype.md) |  |
 |  [DataPlugin](./kibana-plugin-plugins-data-public.dataplugin.md) |  |
 |  [DuplicateIndexPatternError](./kibana-plugin-plugins-data-public.duplicateindexpatternerror.md) |  |
-|  [FieldFormat](./kibana-plugin-plugins-data-public.fieldformat.md) |  |
 |  [FilterManager](./kibana-plugin-plugins-data-public.filtermanager.md) |  |
 |  [IndexPattern](./kibana-plugin-plugins-data-public.indexpattern.md) |  |
 |  [IndexPatternField](./kibana-plugin-plugins-data-public.indexpatternfield.md) |  |
 |  [IndexPatternsService](./kibana-plugin-plugins-data-public.indexpatternsservice.md) |  |
 |  [OptionedParamType](./kibana-plugin-plugins-data-public.optionedparamtype.md) |  |
-|  [PainlessError](./kibana-plugin-plugins-data-public.painlesserror.md) |  |
-|  [SearchInterceptor](./kibana-plugin-plugins-data-public.searchinterceptor.md) |  |
 |  [SearchSource](./kibana-plugin-plugins-data-public.searchsource.md) | \* |
-|  [SearchTimeoutError](./kibana-plugin-plugins-data-public.searchtimeouterror.md) | Request Failure - When an entire multi request fails |
 |  [TimeHistory](./kibana-plugin-plugins-data-public.timehistory.md) |  |
 
 ## Enumerations
@@ -35,7 +31,6 @@
 |  [QuerySuggestionTypes](./kibana-plugin-plugins-data-public.querysuggestiontypes.md) |  |
 |  [SearchSessionState](./kibana-plugin-plugins-data-public.searchsessionstate.md) | Possible state that current session can be in |
 |  [SortDirection](./kibana-plugin-plugins-data-public.sortdirection.md) |  |
-|  [TimeoutErrorMode](./kibana-plugin-plugins-data-public.timeouterrormode.md) |  |
 
 ## Functions
 
@@ -45,7 +40,6 @@
 |  [generateFilters(filterManager, field, values, operation, index)](./kibana-plugin-plugins-data-public.generatefilters.md) | Generate filter objects, as a result of triggering a filter action on a specific index pattern field. |
 |  [getDefaultQuery(language)](./kibana-plugin-plugins-data-public.getdefaultquery.md) |  |
 |  [getDisplayValueFromFilter(filter, indexPatterns)](./kibana-plugin-plugins-data-public.getdisplayvaluefromfilter.md) |  |
-|  [getEsPreference(uiSettings, sessionId)](./kibana-plugin-plugins-data-public.getespreference.md) |  |
 |  [getEsQueryConfig(config)](./kibana-plugin-plugins-data-public.getesqueryconfig.md) |  |
 |  [getSearchParamsFromRequest(searchRequest, dependencies)](./kibana-plugin-plugins-data-public.getsearchparamsfromrequest.md) |  |
 |  [getTime(indexPattern, timeRange, options)](./kibana-plugin-plugins-data-public.gettime.md) |  |
@@ -64,17 +58,15 @@
 |  [DataPublicPluginStart](./kibana-plugin-plugins-data-public.datapublicpluginstart.md) | Data plugin public Start contract |
 |  [DataPublicPluginStartActions](./kibana-plugin-plugins-data-public.datapublicpluginstartactions.md) | utilities to generate filters from action context |
 |  [DataPublicPluginStartUi](./kibana-plugin-plugins-data-public.datapublicpluginstartui.md) | Data plugin prewired UI components |
-|  [FieldFormatConfig](./kibana-plugin-plugins-data-public.fieldformatconfig.md) |  |
+|  [GetFieldsOptions](./kibana-plugin-plugins-data-public.getfieldsoptions.md) |  |
 |  [IDataPluginServices](./kibana-plugin-plugins-data-public.idatapluginservices.md) |  |
 |  [IEsSearchRequest](./kibana-plugin-plugins-data-public.iessearchrequest.md) |  |
 |  [IFieldType](./kibana-plugin-plugins-data-public.ifieldtype.md) |  |
 |  [IIndexPattern](./kibana-plugin-plugins-data-public.iindexpattern.md) |  |
-|  [IIndexPatternFieldList](./kibana-plugin-plugins-data-public.iindexpatternfieldlist.md) |  |
 |  [IKibanaSearchRequest](./kibana-plugin-plugins-data-public.ikibanasearchrequest.md) |  |
 |  [IKibanaSearchResponse](./kibana-plugin-plugins-data-public.ikibanasearchresponse.md) |  |
 |  [IndexPatternAttributes](./kibana-plugin-plugins-data-public.indexpatternattributes.md) | Interface for an index pattern saved object |
 |  [IndexPatternSpec](./kibana-plugin-plugins-data-public.indexpatternspec.md) | Static index pattern format Serialized data object, representing index pattern attributes and state |
-|  [IndexPatternTypeMeta](./kibana-plugin-plugins-data-public.indexpatterntypemeta.md) |  |
 |  [ISearchOptions](./kibana-plugin-plugins-data-public.isearchoptions.md) |  |
 |  [ISearchSetup](./kibana-plugin-plugins-data-public.isearchsetup.md) | The setup contract exposed by the Search plugin exposes the search strategy extension point. |
 |  [ISearchStart](./kibana-plugin-plugins-data-public.isearchstart.md) | search service |
@@ -90,8 +82,6 @@
 |  [RefreshInterval](./kibana-plugin-plugins-data-public.refreshinterval.md) |  |
 |  [SavedQuery](./kibana-plugin-plugins-data-public.savedquery.md) |  |
 |  [SavedQueryService](./kibana-plugin-plugins-data-public.savedqueryservice.md) |  |
-|  [SearchError](./kibana-plugin-plugins-data-public.searcherror.md) |  |
-|  [SearchInterceptorDeps](./kibana-plugin-plugins-data-public.searchinterceptordeps.md) |  |
 |  [SearchSessionInfoProvider](./kibana-plugin-plugins-data-public.searchsessioninfoprovider.md) | Provide info about current search session to be stored in the Search Session saved object |
 |  [SearchSourceFields](./kibana-plugin-plugins-data-public.searchsourcefields.md) | search source fields |
 |  [WaitUntilNextSessionCompletesOptions](./kibana-plugin-plugins-data-public.waituntilnextsessioncompletesoptions.md) | Options for [waitUntilNextSessionCompletes$()](./kibana-plugin-plugins-data-public.waituntilnextsessioncompletes_.md) |
@@ -104,7 +94,6 @@
 |  [AggGroupLabels](./kibana-plugin-plugins-data-public.agggrouplabels.md) |  |
 |  [AggGroupNames](./kibana-plugin-plugins-data-public.agggroupnames.md) |  |
 |  [APPLY\_FILTER\_TRIGGER](./kibana-plugin-plugins-data-public.apply_filter_trigger.md) |  |
-|  [baseFormattersPublic](./kibana-plugin-plugins-data-public.baseformatterspublic.md) |  |
 |  [castEsToKbnFieldTypeName](./kibana-plugin-plugins-data-public.castestokbnfieldtypename.md) |  |
 |  [connectToQueryState](./kibana-plugin-plugins-data-public.connecttoquerystate.md) | Helper to setup two-way syncing of global data and a state container |
 |  [createSavedQueryService](./kibana-plugin-plugins-data-public.createsavedqueryservice.md) |  |
@@ -114,7 +103,6 @@
 |  [esQuery](./kibana-plugin-plugins-data-public.esquery.md) |  |
 |  [exporters](./kibana-plugin-plugins-data-public.exporters.md) |  |
 |  [extractSearchSourceReferences](./kibana-plugin-plugins-data-public.extractsearchsourcereferences.md) |  |
-|  [fieldFormats](./kibana-plugin-plugins-data-public.fieldformats.md) |  |
 |  [fieldList](./kibana-plugin-plugins-data-public.fieldlist.md) |  |
 |  [FilterItem](./kibana-plugin-plugins-data-public.filteritem.md) |  |
 |  [FilterLabel](./kibana-plugin-plugins-data-public.filterlabel.md) |  |
@@ -143,41 +131,33 @@
 |  Type Alias | Description |
 |  --- | --- |
 |  [AggConfigOptions](./kibana-plugin-plugins-data-public.aggconfigoptions.md) |  |
+|  [AggConfigSerialized](./kibana-plugin-plugins-data-public.aggconfigserialized.md) | \* |
 |  [AggGroupName](./kibana-plugin-plugins-data-public.agggroupname.md) |  |
 |  [AggParam](./kibana-plugin-plugins-data-public.aggparam.md) |  |
+|  [AggregationRestrictions](./kibana-plugin-plugins-data-public.aggregationrestrictions.md) |  |
 |  [AggsStart](./kibana-plugin-plugins-data-public.aggsstart.md) | AggsStart represents the actual external contract as AggsCommonStart is only used internally. The difference is that AggsStart includes the typings for the registry with initialized agg types. |
 |  [AutocompleteStart](./kibana-plugin-plugins-data-public.autocompletestart.md) | \* |
 |  [AutoRefreshDoneFn](./kibana-plugin-plugins-data-public.autorefreshdonefn.md) |  |
 |  [CustomFilter](./kibana-plugin-plugins-data-public.customfilter.md) |  |
 |  [EsaggsExpressionFunctionDefinition](./kibana-plugin-plugins-data-public.esaggsexpressionfunctiondefinition.md) |  |
-|  [EsdslExpressionFunctionDefinition](./kibana-plugin-plugins-data-public.esdslexpressionfunctiondefinition.md) |  |
 |  [EsQueryConfig](./kibana-plugin-plugins-data-public.esqueryconfig.md) |  |
 |  [EsQuerySortValue](./kibana-plugin-plugins-data-public.esquerysortvalue.md) |  |
-|  [EsRawResponseExpressionTypeDefinition](./kibana-plugin-plugins-data-public.esrawresponseexpressiontypedefinition.md) |  |
 |  [ExecutionContextSearch](./kibana-plugin-plugins-data-public.executioncontextsearch.md) |  |
 |  [ExistsFilter](./kibana-plugin-plugins-data-public.existsfilter.md) |  |
 |  [ExpressionFunctionKibana](./kibana-plugin-plugins-data-public.expressionfunctionkibana.md) |  |
 |  [ExpressionFunctionKibanaContext](./kibana-plugin-plugins-data-public.expressionfunctionkibanacontext.md) |  |
 |  [ExpressionValueSearchContext](./kibana-plugin-plugins-data-public.expressionvaluesearchcontext.md) |  |
-|  [FieldFormatId](./kibana-plugin-plugins-data-public.fieldformatid.md) |  id type is needed for creating custom converters. |
-|  [FieldFormatsContentType](./kibana-plugin-plugins-data-public.fieldformatscontenttype.md) | \* |
-|  [FieldFormatsGetConfigFn](./kibana-plugin-plugins-data-public.fieldformatsgetconfigfn.md) |  |
-|  [FieldFormatsStart](./kibana-plugin-plugins-data-public.fieldformatsstart.md) |  |
 |  [Filter](./kibana-plugin-plugins-data-public.filter.md) |  |
 |  [IAggConfig](./kibana-plugin-plugins-data-public.iaggconfig.md) |  AggConfig This class represents an aggregation, which is displayed in the left-hand nav of the Visualize app. |
 |  [IAggType](./kibana-plugin-plugins-data-public.iaggtype.md) |  |
 |  [IEsError](./kibana-plugin-plugins-data-public.ieserror.md) |  |
 |  [IEsSearchResponse](./kibana-plugin-plugins-data-public.iessearchresponse.md) |  |
-|  [IFieldFormat](./kibana-plugin-plugins-data-public.ifieldformat.md) |  |
-|  [IFieldFormatsRegistry](./kibana-plugin-plugins-data-public.ifieldformatsregistry.md) |  |
 |  [IFieldParamType](./kibana-plugin-plugins-data-public.ifieldparamtype.md) |  |
 |  [IFieldSubType](./kibana-plugin-plugins-data-public.ifieldsubtype.md) |  |
 |  [IMetricAggType](./kibana-plugin-plugins-data-public.imetricaggtype.md) |  |
-|  [IndexPatternAggRestrictions](./kibana-plugin-plugins-data-public.indexpatternaggrestrictions.md) |  |
 |  [IndexPatternLoadExpressionFunctionDefinition](./kibana-plugin-plugins-data-public.indexpatternloadexpressionfunctiondefinition.md) |  |
 |  [IndexPatternsContract](./kibana-plugin-plugins-data-public.indexpatternscontract.md) |  |
 |  [IndexPatternSelectProps](./kibana-plugin-plugins-data-public.indexpatternselectprops.md) |  |
-|  [InputTimeRange](./kibana-plugin-plugins-data-public.inputtimerange.md) |  |
 |  [ISearchGeneric](./kibana-plugin-plugins-data-public.isearchgeneric.md) |  |
 |  [ISearchSource](./kibana-plugin-plugins-data-public.isearchsource.md) | search source interface |
 |  [ISessionsClient](./kibana-plugin-plugins-data-public.isessionsclient.md) |  |
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.painlesserror._constructor_.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.painlesserror._constructor_.md
deleted file mode 100644
index b8f21de3e086ec..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.painlesserror._constructor_.md
+++ /dev/null
@@ -1,21 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [PainlessError](./kibana-plugin-plugins-data-public.painlesserror.md) &gt; [(constructor)](./kibana-plugin-plugins-data-public.painlesserror._constructor_.md)
-
-## PainlessError.(constructor)
-
-Constructs a new instance of the `PainlessError` class
-
-<b>Signature:</b>
-
-```typescript
-constructor(err: IEsError, indexPattern?: IndexPattern);
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  err | <code>IEsError</code> |  |
-|  indexPattern | <code>IndexPattern</code> |  |
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.painlesserror.geterrormessage.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.painlesserror.geterrormessage.md
deleted file mode 100644
index a3b4c51c6c3313..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.painlesserror.geterrormessage.md
+++ /dev/null
@@ -1,22 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [PainlessError](./kibana-plugin-plugins-data-public.painlesserror.md) &gt; [getErrorMessage](./kibana-plugin-plugins-data-public.painlesserror.geterrormessage.md)
-
-## PainlessError.getErrorMessage() method
-
-<b>Signature:</b>
-
-```typescript
-getErrorMessage(application: ApplicationStart): JSX.Element;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  application | <code>ApplicationStart</code> |  |
-
-<b>Returns:</b>
-
-`JSX.Element`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.painlesserror.indexpattern.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.painlesserror.indexpattern.md
deleted file mode 100644
index 4312f2f8d0c91f..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.painlesserror.indexpattern.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [PainlessError](./kibana-plugin-plugins-data-public.painlesserror.md) &gt; [indexPattern](./kibana-plugin-plugins-data-public.painlesserror.indexpattern.md)
-
-## PainlessError.indexPattern property
-
-<b>Signature:</b>
-
-```typescript
-indexPattern?: IndexPattern;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.painlesserror.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.painlesserror.md
deleted file mode 100644
index 3a887d358e2155..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.painlesserror.md
+++ /dev/null
@@ -1,31 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [PainlessError](./kibana-plugin-plugins-data-public.painlesserror.md)
-
-## PainlessError class
-
-<b>Signature:</b>
-
-```typescript
-export declare class PainlessError extends EsError 
-```
-
-## Constructors
-
-|  Constructor | Modifiers | Description |
-|  --- | --- | --- |
-|  [(constructor)(err, indexPattern)](./kibana-plugin-plugins-data-public.painlesserror._constructor_.md) |  | Constructs a new instance of the <code>PainlessError</code> class |
-
-## Properties
-
-|  Property | Modifiers | Type | Description |
-|  --- | --- | --- | --- |
-|  [indexPattern](./kibana-plugin-plugins-data-public.painlesserror.indexpattern.md) |  | <code>IndexPattern</code> |  |
-|  [painlessStack](./kibana-plugin-plugins-data-public.painlesserror.painlessstack.md) |  | <code>string</code> |  |
-
-## Methods
-
-|  Method | Modifiers | Description |
-|  --- | --- | --- |
-|  [getErrorMessage(application)](./kibana-plugin-plugins-data-public.painlesserror.geterrormessage.md) |  |  |
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.painlesserror.painlessstack.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.painlesserror.painlessstack.md
deleted file mode 100644
index a7e6920b2ae219..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.painlesserror.painlessstack.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [PainlessError](./kibana-plugin-plugins-data-public.painlesserror.md) &gt; [painlessStack](./kibana-plugin-plugins-data-public.painlesserror.painlessstack.md)
-
-## PainlessError.painlessStack property
-
-<b>Signature:</b>
-
-```typescript
-painlessStack?: string;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.phrasefilter.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.phrasefilter.md
index 850aff0f6cd85d..cc1007655ecf38 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.phrasefilter.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.phrasefilter.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.0
+> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.phrasesfilter.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.phrasesfilter.md
index a28dba5b1cd3fd..48a41dc34497f7 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.phrasesfilter.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.phrasesfilter.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.0
+> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystringinputprops.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystringinputprops.md
index bd60f31bfe8f21..f9ef1d87a2dcc2 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystringinputprops.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystringinputprops.md
@@ -39,4 +39,5 @@ export interface QueryStringInputProps
 |  [size](./kibana-plugin-plugins-data-public.querystringinputprops.size.md) | <code>SuggestionsListSize</code> |  |
 |  [storageKey](./kibana-plugin-plugins-data-public.querystringinputprops.storagekey.md) | <code>string</code> |  |
 |  [submitOnBlur](./kibana-plugin-plugins-data-public.querystringinputprops.submitonblur.md) | <code>boolean</code> |  |
+|  [timeRangeForSuggestionsOverride](./kibana-plugin-plugins-data-public.querystringinputprops.timerangeforsuggestionsoverride.md) | <code>boolean</code> | Override whether autocomplete suggestions are restricted by time range. |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystringinputprops.timerangeforsuggestionsoverride.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystringinputprops.timerangeforsuggestionsoverride.md
new file mode 100644
index 00000000000000..baa6c34aeadba7
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.querystringinputprops.timerangeforsuggestionsoverride.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [QueryStringInputProps](./kibana-plugin-plugins-data-public.querystringinputprops.md) &gt; [timeRangeForSuggestionsOverride](./kibana-plugin-plugins-data-public.querystringinputprops.timerangeforsuggestionsoverride.md)
+
+## QueryStringInputProps.timeRangeForSuggestionsOverride property
+
+Override whether autocomplete suggestions are restricted by time range.
+
+<b>Signature:</b>
+
+```typescript
+timeRangeForSuggestionsOverride?: boolean;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.rangefilter.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.rangefilter.md
index 91dd7c13c472e7..5d452d759c9342 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.rangefilter.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.rangefilter.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.0
+> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.rangefiltermeta.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.rangefiltermeta.md
index 291dc90c3971df..eefb773f5727f3 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.rangefiltermeta.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.rangefiltermeta.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.0
+> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.rangefilterparams.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.rangefilterparams.md
index 42db2d353befaf..df78be16e6d018 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.rangefilterparams.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.rangefilterparams.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.0
+> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.md
deleted file mode 100644
index 65b46bf6cba4de..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.md
+++ /dev/null
@@ -1,23 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchError](./kibana-plugin-plugins-data-public.searcherror.md)
-
-## SearchError interface
-
-<b>Signature:</b>
-
-```typescript
-export interface SearchError 
-```
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [message](./kibana-plugin-plugins-data-public.searcherror.message.md) | <code>string</code> |  |
-|  [name](./kibana-plugin-plugins-data-public.searcherror.name.md) | <code>string</code> |  |
-|  [path](./kibana-plugin-plugins-data-public.searcherror.path.md) | <code>string</code> |  |
-|  [status](./kibana-plugin-plugins-data-public.searcherror.status.md) | <code>string</code> |  |
-|  [title](./kibana-plugin-plugins-data-public.searcherror.title.md) | <code>string</code> |  |
-|  [type](./kibana-plugin-plugins-data-public.searcherror.type.md) | <code>string</code> |  |
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.message.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.message.md
deleted file mode 100644
index 5e2de2fbf7f429..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.message.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchError](./kibana-plugin-plugins-data-public.searcherror.md) &gt; [message](./kibana-plugin-plugins-data-public.searcherror.message.md)
-
-## SearchError.message property
-
-<b>Signature:</b>
-
-```typescript
-message: string;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.name.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.name.md
deleted file mode 100644
index 8ad7bb5fcfd817..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.name.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchError](./kibana-plugin-plugins-data-public.searcherror.md) &gt; [name](./kibana-plugin-plugins-data-public.searcherror.name.md)
-
-## SearchError.name property
-
-<b>Signature:</b>
-
-```typescript
-name: string;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.path.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.path.md
deleted file mode 100644
index 833c16e73ea8ef..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.path.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchError](./kibana-plugin-plugins-data-public.searcherror.md) &gt; [path](./kibana-plugin-plugins-data-public.searcherror.path.md)
-
-## SearchError.path property
-
-<b>Signature:</b>
-
-```typescript
-path: string;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.status.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.status.md
deleted file mode 100644
index ae1a947da0abb5..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.status.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchError](./kibana-plugin-plugins-data-public.searcherror.md) &gt; [status](./kibana-plugin-plugins-data-public.searcherror.status.md)
-
-## SearchError.status property
-
-<b>Signature:</b>
-
-```typescript
-status: string;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.title.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.title.md
deleted file mode 100644
index aa73ab3b5790c5..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.title.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchError](./kibana-plugin-plugins-data-public.searcherror.md) &gt; [title](./kibana-plugin-plugins-data-public.searcherror.title.md)
-
-## SearchError.title property
-
-<b>Signature:</b>
-
-```typescript
-title: string;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.type.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.type.md
deleted file mode 100644
index dde447a9059c55..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searcherror.type.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchError](./kibana-plugin-plugins-data-public.searcherror.md) &gt; [type](./kibana-plugin-plugins-data-public.searcherror.type.md)
-
-## SearchError.type property
-
-<b>Signature:</b>
-
-```typescript
-type: string;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor._constructor_.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor._constructor_.md
deleted file mode 100644
index 4c676393008837..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor._constructor_.md
+++ /dev/null
@@ -1,20 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptor](./kibana-plugin-plugins-data-public.searchinterceptor.md) &gt; [(constructor)](./kibana-plugin-plugins-data-public.searchinterceptor._constructor_.md)
-
-## SearchInterceptor.(constructor)
-
-Constructs a new instance of the `SearchInterceptor` class
-
-<b>Signature:</b>
-
-```typescript
-constructor(deps: SearchInterceptorDeps);
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  deps | <code>SearchInterceptorDeps</code> |  |
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.md
deleted file mode 100644
index e1b27f45c6339c..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.md
+++ /dev/null
@@ -1,26 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptor](./kibana-plugin-plugins-data-public.searchinterceptor.md)
-
-## SearchInterceptor class
-
-<b>Signature:</b>
-
-```typescript
-export declare class SearchInterceptor 
-```
-
-## Constructors
-
-|  Constructor | Modifiers | Description |
-|  --- | --- | --- |
-|  [(constructor)(deps)](./kibana-plugin-plugins-data-public.searchinterceptor._constructor_.md) |  | Constructs a new instance of the <code>SearchInterceptor</code> class |
-
-## Methods
-
-|  Method | Modifiers | Description |
-|  --- | --- | --- |
-|  [search({ id, ...request }, options)](./kibana-plugin-plugins-data-public.searchinterceptor.search.md) |  | Searches using the given <code>search</code> method. Overrides the <code>AbortSignal</code> with one that will abort either when the request times out, or when the original <code>AbortSignal</code> is aborted. Updates <code>pendingCount$</code> when the request is started/finalized. |
-|  [showError(e)](./kibana-plugin-plugins-data-public.searchinterceptor.showerror.md) |  |  |
-|  [stop()](./kibana-plugin-plugins-data-public.searchinterceptor.stop.md) |  |  |
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.search.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.search.md
deleted file mode 100644
index ab5ecbac119f30..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.search.md
+++ /dev/null
@@ -1,27 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptor](./kibana-plugin-plugins-data-public.searchinterceptor.md) &gt; [search](./kibana-plugin-plugins-data-public.searchinterceptor.search.md)
-
-## SearchInterceptor.search() method
-
-Searches using the given `search` method. Overrides the `AbortSignal` with one that will abort either when the request times out, or when the original `AbortSignal` is aborted. Updates `pendingCount$` when the request is started/finalized.
-
-<b>Signature:</b>
-
-```typescript
-search({ id, ...request }: IKibanaSearchRequest, options?: IAsyncSearchOptions): import("rxjs").Observable<IKibanaSearchResponse<any>>;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  { id, ...request } | <code>IKibanaSearchRequest</code> |  |
-|  options | <code>IAsyncSearchOptions</code> |  |
-
-<b>Returns:</b>
-
-`import("rxjs").Observable<IKibanaSearchResponse<any>>`
-
-`Observable` emitting the search response or an error.
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.showerror.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.showerror.md
deleted file mode 100644
index 92e851c783dd06..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.showerror.md
+++ /dev/null
@@ -1,22 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptor](./kibana-plugin-plugins-data-public.searchinterceptor.md) &gt; [showError](./kibana-plugin-plugins-data-public.searchinterceptor.showerror.md)
-
-## SearchInterceptor.showError() method
-
-<b>Signature:</b>
-
-```typescript
-showError(e: Error): void;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  e | <code>Error</code> |  |
-
-<b>Returns:</b>
-
-`void`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.stop.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.stop.md
deleted file mode 100644
index e0d77c5d135376..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptor.stop.md
+++ /dev/null
@@ -1,15 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptor](./kibana-plugin-plugins-data-public.searchinterceptor.md) &gt; [stop](./kibana-plugin-plugins-data-public.searchinterceptor.stop.md)
-
-## SearchInterceptor.stop() method
-
-<b>Signature:</b>
-
-```typescript
-stop(): void;
-```
-<b>Returns:</b>
-
-`void`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.bfetch.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.bfetch.md
deleted file mode 100644
index 5b7c635c715298..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.bfetch.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptorDeps](./kibana-plugin-plugins-data-public.searchinterceptordeps.md) &gt; [bfetch](./kibana-plugin-plugins-data-public.searchinterceptordeps.bfetch.md)
-
-## SearchInterceptorDeps.bfetch property
-
-<b>Signature:</b>
-
-```typescript
-bfetch: BfetchPublicSetup;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.http.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.http.md
deleted file mode 100644
index 66c31bb6fcf805..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.http.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptorDeps](./kibana-plugin-plugins-data-public.searchinterceptordeps.md) &gt; [http](./kibana-plugin-plugins-data-public.searchinterceptordeps.http.md)
-
-## SearchInterceptorDeps.http property
-
-<b>Signature:</b>
-
-```typescript
-http: CoreSetup['http'];
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.md
deleted file mode 100644
index 543566b783c231..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.md
+++ /dev/null
@@ -1,24 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptorDeps](./kibana-plugin-plugins-data-public.searchinterceptordeps.md)
-
-## SearchInterceptorDeps interface
-
-<b>Signature:</b>
-
-```typescript
-export interface SearchInterceptorDeps 
-```
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [bfetch](./kibana-plugin-plugins-data-public.searchinterceptordeps.bfetch.md) | <code>BfetchPublicSetup</code> |  |
-|  [http](./kibana-plugin-plugins-data-public.searchinterceptordeps.http.md) | <code>CoreSetup['http']</code> |  |
-|  [session](./kibana-plugin-plugins-data-public.searchinterceptordeps.session.md) | <code>ISessionService</code> |  |
-|  [startServices](./kibana-plugin-plugins-data-public.searchinterceptordeps.startservices.md) | <code>Promise&lt;[CoreStart, any, unknown]&gt;</code> |  |
-|  [toasts](./kibana-plugin-plugins-data-public.searchinterceptordeps.toasts.md) | <code>ToastsSetup</code> |  |
-|  [uiSettings](./kibana-plugin-plugins-data-public.searchinterceptordeps.uisettings.md) | <code>CoreSetup['uiSettings']</code> |  |
-|  [usageCollector](./kibana-plugin-plugins-data-public.searchinterceptordeps.usagecollector.md) | <code>SearchUsageCollector</code> |  |
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.session.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.session.md
deleted file mode 100644
index 40d00483317ba6..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.session.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptorDeps](./kibana-plugin-plugins-data-public.searchinterceptordeps.md) &gt; [session](./kibana-plugin-plugins-data-public.searchinterceptordeps.session.md)
-
-## SearchInterceptorDeps.session property
-
-<b>Signature:</b>
-
-```typescript
-session: ISessionService;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.startservices.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.startservices.md
deleted file mode 100644
index 855d0652058b87..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.startservices.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptorDeps](./kibana-plugin-plugins-data-public.searchinterceptordeps.md) &gt; [startServices](./kibana-plugin-plugins-data-public.searchinterceptordeps.startservices.md)
-
-## SearchInterceptorDeps.startServices property
-
-<b>Signature:</b>
-
-```typescript
-startServices: Promise<[CoreStart, any, unknown]>;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.toasts.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.toasts.md
deleted file mode 100644
index 1f560dfa5cf7c3..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.toasts.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptorDeps](./kibana-plugin-plugins-data-public.searchinterceptordeps.md) &gt; [toasts](./kibana-plugin-plugins-data-public.searchinterceptordeps.toasts.md)
-
-## SearchInterceptorDeps.toasts property
-
-<b>Signature:</b>
-
-```typescript
-toasts: ToastsSetup;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.uisettings.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.uisettings.md
deleted file mode 100644
index a34d223c34ac2b..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.uisettings.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptorDeps](./kibana-plugin-plugins-data-public.searchinterceptordeps.md) &gt; [uiSettings](./kibana-plugin-plugins-data-public.searchinterceptordeps.uisettings.md)
-
-## SearchInterceptorDeps.uiSettings property
-
-<b>Signature:</b>
-
-```typescript
-uiSettings: CoreSetup['uiSettings'];
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.usagecollector.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.usagecollector.md
deleted file mode 100644
index 21afce19276769..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchinterceptordeps.usagecollector.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchInterceptorDeps](./kibana-plugin-plugins-data-public.searchinterceptordeps.md) &gt; [usageCollector](./kibana-plugin-plugins-data-public.searchinterceptordeps.usagecollector.md)
-
-## SearchInterceptorDeps.usageCollector property
-
-<b>Signature:</b>
-
-```typescript
-usageCollector?: SearchUsageCollector;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.fetch.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.fetch.md
index 977f875b214e5e..b00a7f31318eb5 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.fetch.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchsource.fetch.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Use the `fetch$` method instead  8.0
+> Use the `fetch$` method instead  8.1
 > 
 
 Fetch this source and reject the returned Promise on error
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchtimeouterror._constructor_.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchtimeouterror._constructor_.md
deleted file mode 100644
index b4eecca665e827..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchtimeouterror._constructor_.md
+++ /dev/null
@@ -1,21 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchTimeoutError](./kibana-plugin-plugins-data-public.searchtimeouterror.md) &gt; [(constructor)](./kibana-plugin-plugins-data-public.searchtimeouterror._constructor_.md)
-
-## SearchTimeoutError.(constructor)
-
-Constructs a new instance of the `SearchTimeoutError` class
-
-<b>Signature:</b>
-
-```typescript
-constructor(err: Record<string, any>, mode: TimeoutErrorMode);
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  err | <code>Record&lt;string, any&gt;</code> |  |
-|  mode | <code>TimeoutErrorMode</code> |  |
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchtimeouterror.geterrormessage.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchtimeouterror.geterrormessage.md
deleted file mode 100644
index 58ef953c9d7dbd..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchtimeouterror.geterrormessage.md
+++ /dev/null
@@ -1,22 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchTimeoutError](./kibana-plugin-plugins-data-public.searchtimeouterror.md) &gt; [getErrorMessage](./kibana-plugin-plugins-data-public.searchtimeouterror.geterrormessage.md)
-
-## SearchTimeoutError.getErrorMessage() method
-
-<b>Signature:</b>
-
-```typescript
-getErrorMessage(application: ApplicationStart): JSX.Element;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  application | <code>ApplicationStart</code> |  |
-
-<b>Returns:</b>
-
-`JSX.Element`
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchtimeouterror.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchtimeouterror.md
deleted file mode 100644
index 5c0bec04dcfbc1..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchtimeouterror.md
+++ /dev/null
@@ -1,32 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchTimeoutError](./kibana-plugin-plugins-data-public.searchtimeouterror.md)
-
-## SearchTimeoutError class
-
-Request Failure - When an entire multi request fails
-
-<b>Signature:</b>
-
-```typescript
-export declare class SearchTimeoutError extends KbnError 
-```
-
-## Constructors
-
-|  Constructor | Modifiers | Description |
-|  --- | --- | --- |
-|  [(constructor)(err, mode)](./kibana-plugin-plugins-data-public.searchtimeouterror._constructor_.md) |  | Constructs a new instance of the <code>SearchTimeoutError</code> class |
-
-## Properties
-
-|  Property | Modifiers | Type | Description |
-|  --- | --- | --- | --- |
-|  [mode](./kibana-plugin-plugins-data-public.searchtimeouterror.mode.md) |  | <code>TimeoutErrorMode</code> |  |
-
-## Methods
-
-|  Method | Modifiers | Description |
-|  --- | --- | --- |
-|  [getErrorMessage(application)](./kibana-plugin-plugins-data-public.searchtimeouterror.geterrormessage.md) |  |  |
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchtimeouterror.mode.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchtimeouterror.mode.md
deleted file mode 100644
index d534a73eca2ec2..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.searchtimeouterror.mode.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [SearchTimeoutError](./kibana-plugin-plugins-data-public.searchtimeouterror.md) &gt; [mode](./kibana-plugin-plugins-data-public.searchtimeouterror.mode.md)
-
-## SearchTimeoutError.mode property
-
-<b>Signature:</b>
-
-```typescript
-mode: TimeoutErrorMode;
-```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.timeouterrormode.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.timeouterrormode.md
deleted file mode 100644
index bbf789b7dcf268..00000000000000
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.timeouterrormode.md
+++ /dev/null
@@ -1,19 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [TimeoutErrorMode](./kibana-plugin-plugins-data-public.timeouterrormode.md)
-
-## TimeoutErrorMode enum
-
-<b>Signature:</b>
-
-```typescript
-export declare enum TimeoutErrorMode 
-```
-
-## Enumeration Members
-
-|  Member | Value | Description |
-|  --- | --- | --- |
-|  CHANGE | <code>1</code> |  |
-|  CONTACT | <code>0</code> |  |
-
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ui_settings.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ui_settings.md
index bdfc881878efd6..fba9afd6f6648c 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ui_settings.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ui_settings.md
@@ -24,13 +24,6 @@ UI_SETTINGS: {
     readonly HISTOGRAM_BAR_TARGET: "histogram:barTarget";
     readonly HISTOGRAM_MAX_BARS: "histogram:maxBars";
     readonly HISTORY_LIMIT: "history:limit";
-    readonly SHORT_DOTS_ENABLE: "shortDots:enable";
-    readonly FORMAT_DEFAULT_TYPE_MAP: "format:defaultTypeMap";
-    readonly FORMAT_NUMBER_DEFAULT_PATTERN: "format:number:defaultPattern";
-    readonly FORMAT_PERCENT_DEFAULT_PATTERN: "format:percent:defaultPattern";
-    readonly FORMAT_BYTES_DEFAULT_PATTERN: "format:bytes:defaultPattern";
-    readonly FORMAT_CURRENCY_DEFAULT_PATTERN: "format:currency:defaultPattern";
-    readonly FORMAT_NUMBER_DEFAULT_LOCALE: "format:number:defaultLocale";
     readonly TIMEPICKER_REFRESH_INTERVAL_DEFAULTS: "timepicker:refreshIntervalDefaults";
     readonly TIMEPICKER_QUICK_RANGES: "timepicker:quickRanges";
     readonly TIMEPICKER_TIME_DEFAULTS: "timepicker:timeDefaults";
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggconfigoptions.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggconfigoptions.md
deleted file mode 100644
index effb2e798ad6fd..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggconfigoptions.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggConfigOptions](./kibana-plugin-plugins-data-server.aggconfigoptions.md)
-
-## AggConfigOptions type
-
-<b>Signature:</b>
-
-```typescript
-export declare type AggConfigOptions = Assign<AggConfigSerialized, {
-    type: IAggType;
-}>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggavg.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggavg.md
deleted file mode 100644
index dd5884c0a7c477..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggavg.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggAvg](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggavg.md)
-
-## AggFunctionsMapping.aggAvg property
-
-<b>Signature:</b>
-
-```typescript
-aggAvg: ReturnType<typeof aggAvg>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketavg.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketavg.md
deleted file mode 100644
index 9a36328eade203..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketavg.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggBucketAvg](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketavg.md)
-
-## AggFunctionsMapping.aggBucketAvg property
-
-<b>Signature:</b>
-
-```typescript
-aggBucketAvg: ReturnType<typeof aggBucketAvg>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketmax.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketmax.md
deleted file mode 100644
index 7880300497a8c0..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketmax.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggBucketMax](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketmax.md)
-
-## AggFunctionsMapping.aggBucketMax property
-
-<b>Signature:</b>
-
-```typescript
-aggBucketMax: ReturnType<typeof aggBucketMax>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketmin.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketmin.md
deleted file mode 100644
index d806b610e4ad2c..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketmin.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggBucketMin](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketmin.md)
-
-## AggFunctionsMapping.aggBucketMin property
-
-<b>Signature:</b>
-
-```typescript
-aggBucketMin: ReturnType<typeof aggBucketMin>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketsum.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketsum.md
deleted file mode 100644
index 17f1d24f2736f7..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketsum.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggBucketSum](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketsum.md)
-
-## AggFunctionsMapping.aggBucketSum property
-
-<b>Signature:</b>
-
-```typescript
-aggBucketSum: ReturnType<typeof aggBucketSum>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggcardinality.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggcardinality.md
deleted file mode 100644
index fd31251fd6b22b..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggcardinality.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggCardinality](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggcardinality.md)
-
-## AggFunctionsMapping.aggCardinality property
-
-<b>Signature:</b>
-
-```typescript
-aggCardinality: ReturnType<typeof aggCardinality>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggcount.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggcount.md
deleted file mode 100644
index 65aae8bc15dfe1..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggcount.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggCount](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggcount.md)
-
-## AggFunctionsMapping.aggCount property
-
-<b>Signature:</b>
-
-```typescript
-aggCount: ReturnType<typeof aggCount>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggcumulativesum.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggcumulativesum.md
deleted file mode 100644
index 7c5d29391594a9..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggcumulativesum.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggCumulativeSum](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggcumulativesum.md)
-
-## AggFunctionsMapping.aggCumulativeSum property
-
-<b>Signature:</b>
-
-```typescript
-aggCumulativeSum: ReturnType<typeof aggCumulativeSum>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggdatehistogram.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggdatehistogram.md
deleted file mode 100644
index ca018cc6881e29..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggdatehistogram.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggDateHistogram](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggdatehistogram.md)
-
-## AggFunctionsMapping.aggDateHistogram property
-
-<b>Signature:</b>
-
-```typescript
-aggDateHistogram: ReturnType<typeof aggDateHistogram>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggdaterange.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggdaterange.md
deleted file mode 100644
index dc2019e761e490..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggdaterange.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggDateRange](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggdaterange.md)
-
-## AggFunctionsMapping.aggDateRange property
-
-<b>Signature:</b>
-
-```typescript
-aggDateRange: ReturnType<typeof aggDateRange>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggderivative.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggderivative.md
deleted file mode 100644
index c77054ca0a39b5..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggderivative.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggDerivative](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggderivative.md)
-
-## AggFunctionsMapping.aggDerivative property
-
-<b>Signature:</b>
-
-```typescript
-aggDerivative: ReturnType<typeof aggDerivative>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggfilter.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggfilter.md
deleted file mode 100644
index 6f77cd69ca1a69..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggfilter.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggFilter](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggfilter.md)
-
-## AggFunctionsMapping.aggFilter property
-
-<b>Signature:</b>
-
-```typescript
-aggFilter: ReturnType<typeof aggFilter>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggfilteredmetric.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggfilteredmetric.md
deleted file mode 100644
index 9885a0afa40c6a..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggfilteredmetric.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggFilteredMetric](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggfilteredmetric.md)
-
-## AggFunctionsMapping.aggFilteredMetric property
-
-<b>Signature:</b>
-
-```typescript
-aggFilteredMetric: ReturnType<typeof aggFilteredMetric>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggfilters.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggfilters.md
deleted file mode 100644
index 59cc96785ddb00..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggfilters.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggFilters](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggfilters.md)
-
-## AggFunctionsMapping.aggFilters property
-
-<b>Signature:</b>
-
-```typescript
-aggFilters: ReturnType<typeof aggFilters>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeobounds.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeobounds.md
deleted file mode 100644
index e43df684f792b7..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeobounds.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggGeoBounds](./kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeobounds.md)
-
-## AggFunctionsMapping.aggGeoBounds property
-
-<b>Signature:</b>
-
-```typescript
-aggGeoBounds: ReturnType<typeof aggGeoBounds>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeocentroid.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeocentroid.md
deleted file mode 100644
index bad7afcdd01795..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeocentroid.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggGeoCentroid](./kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeocentroid.md)
-
-## AggFunctionsMapping.aggGeoCentroid property
-
-<b>Signature:</b>
-
-```typescript
-aggGeoCentroid: ReturnType<typeof aggGeoCentroid>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeohash.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeohash.md
deleted file mode 100644
index 45aca882bb3830..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeohash.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggGeoHash](./kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeohash.md)
-
-## AggFunctionsMapping.aggGeoHash property
-
-<b>Signature:</b>
-
-```typescript
-aggGeoHash: ReturnType<typeof aggGeoHash>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeotile.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeotile.md
deleted file mode 100644
index 91322c1dadac3a..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeotile.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggGeoTile](./kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeotile.md)
-
-## AggFunctionsMapping.aggGeoTile property
-
-<b>Signature:</b>
-
-```typescript
-aggGeoTile: ReturnType<typeof aggGeoTile>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.agghistogram.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.agghistogram.md
deleted file mode 100644
index b9bf9b549e3e2b..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.agghistogram.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggHistogram](./kibana-plugin-plugins-data-server.aggfunctionsmapping.agghistogram.md)
-
-## AggFunctionsMapping.aggHistogram property
-
-<b>Signature:</b>
-
-```typescript
-aggHistogram: ReturnType<typeof aggHistogram>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggiprange.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggiprange.md
deleted file mode 100644
index 76f9e2c25a6db3..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggiprange.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggIpRange](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggiprange.md)
-
-## AggFunctionsMapping.aggIpRange property
-
-<b>Signature:</b>
-
-```typescript
-aggIpRange: ReturnType<typeof aggIpRange>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmax.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmax.md
deleted file mode 100644
index b4ef663ac002d6..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmax.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggMax](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmax.md)
-
-## AggFunctionsMapping.aggMax property
-
-<b>Signature:</b>
-
-```typescript
-aggMax: ReturnType<typeof aggMax>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmedian.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmedian.md
deleted file mode 100644
index f84f500d9a24b3..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmedian.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggMedian](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmedian.md)
-
-## AggFunctionsMapping.aggMedian property
-
-<b>Signature:</b>
-
-```typescript
-aggMedian: ReturnType<typeof aggMedian>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmin.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmin.md
deleted file mode 100644
index 80e78f9ddead69..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmin.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggMin](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmin.md)
-
-## AggFunctionsMapping.aggMin property
-
-<b>Signature:</b>
-
-```typescript
-aggMin: ReturnType<typeof aggMin>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmovingavg.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmovingavg.md
deleted file mode 100644
index c182c56f1dcabe..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmovingavg.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggMovingAvg](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmovingavg.md)
-
-## AggFunctionsMapping.aggMovingAvg property
-
-<b>Signature:</b>
-
-```typescript
-aggMovingAvg: ReturnType<typeof aggMovingAvg>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggpercentileranks.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggpercentileranks.md
deleted file mode 100644
index bad66bec9682fa..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggpercentileranks.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggPercentileRanks](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggpercentileranks.md)
-
-## AggFunctionsMapping.aggPercentileRanks property
-
-<b>Signature:</b>
-
-```typescript
-aggPercentileRanks: ReturnType<typeof aggPercentileRanks>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggpercentiles.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggpercentiles.md
deleted file mode 100644
index 7ce8f3f46c3157..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggpercentiles.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggPercentiles](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggpercentiles.md)
-
-## AggFunctionsMapping.aggPercentiles property
-
-<b>Signature:</b>
-
-```typescript
-aggPercentiles: ReturnType<typeof aggPercentiles>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggrange.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggrange.md
deleted file mode 100644
index 0ff87e450185b6..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggrange.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggRange](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggrange.md)
-
-## AggFunctionsMapping.aggRange property
-
-<b>Signature:</b>
-
-```typescript
-aggRange: ReturnType<typeof aggRange>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggserialdiff.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggserialdiff.md
deleted file mode 100644
index f36ee39b68d1f9..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggserialdiff.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggSerialDiff](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggserialdiff.md)
-
-## AggFunctionsMapping.aggSerialDiff property
-
-<b>Signature:</b>
-
-```typescript
-aggSerialDiff: ReturnType<typeof aggSerialDiff>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggsignificantterms.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggsignificantterms.md
deleted file mode 100644
index 4e9bfbedf6ec94..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggsignificantterms.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggSignificantTerms](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggsignificantterms.md)
-
-## AggFunctionsMapping.aggSignificantTerms property
-
-<b>Signature:</b>
-
-```typescript
-aggSignificantTerms: ReturnType<typeof aggSignificantTerms>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggsinglepercentile.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggsinglepercentile.md
deleted file mode 100644
index d1418d7245d731..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggsinglepercentile.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggSinglePercentile](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggsinglepercentile.md)
-
-## AggFunctionsMapping.aggSinglePercentile property
-
-<b>Signature:</b>
-
-```typescript
-aggSinglePercentile: ReturnType<typeof aggSinglePercentile>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggstddeviation.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggstddeviation.md
deleted file mode 100644
index 065a65262027a6..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggstddeviation.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggStdDeviation](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggstddeviation.md)
-
-## AggFunctionsMapping.aggStdDeviation property
-
-<b>Signature:</b>
-
-```typescript
-aggStdDeviation: ReturnType<typeof aggStdDeviation>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggsum.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggsum.md
deleted file mode 100644
index 35521ab040d8d8..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggsum.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggSum](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggsum.md)
-
-## AggFunctionsMapping.aggSum property
-
-<b>Signature:</b>
-
-```typescript
-aggSum: ReturnType<typeof aggSum>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggterms.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggterms.md
deleted file mode 100644
index efc6218107a131..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggterms.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggTerms](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggterms.md)
-
-## AggFunctionsMapping.aggTerms property
-
-<b>Signature:</b>
-
-```typescript
-aggTerms: ReturnType<typeof aggTerms>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggtophit.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggtophit.md
deleted file mode 100644
index 3733486cf22143..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.aggtophit.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) &gt; [aggTopHit](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggtophit.md)
-
-## AggFunctionsMapping.aggTopHit property
-
-<b>Signature:</b>
-
-```typescript
-aggTopHit: ReturnType<typeof aggTopHit>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.md
deleted file mode 100644
index 6b5f854c155f30..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggfunctionsmapping.md
+++ /dev/null
@@ -1,53 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md)
-
-## AggFunctionsMapping interface
-
-A global list of the expression function definitions for each agg type function.
-
-<b>Signature:</b>
-
-```typescript
-export interface AggFunctionsMapping 
-```
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [aggAvg](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggavg.md) | <code>ReturnType&lt;typeof aggAvg&gt;</code> |  |
-|  [aggBucketAvg](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketavg.md) | <code>ReturnType&lt;typeof aggBucketAvg&gt;</code> |  |
-|  [aggBucketMax](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketmax.md) | <code>ReturnType&lt;typeof aggBucketMax&gt;</code> |  |
-|  [aggBucketMin](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketmin.md) | <code>ReturnType&lt;typeof aggBucketMin&gt;</code> |  |
-|  [aggBucketSum](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggbucketsum.md) | <code>ReturnType&lt;typeof aggBucketSum&gt;</code> |  |
-|  [aggCardinality](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggcardinality.md) | <code>ReturnType&lt;typeof aggCardinality&gt;</code> |  |
-|  [aggCount](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggcount.md) | <code>ReturnType&lt;typeof aggCount&gt;</code> |  |
-|  [aggCumulativeSum](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggcumulativesum.md) | <code>ReturnType&lt;typeof aggCumulativeSum&gt;</code> |  |
-|  [aggDateHistogram](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggdatehistogram.md) | <code>ReturnType&lt;typeof aggDateHistogram&gt;</code> |  |
-|  [aggDateRange](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggdaterange.md) | <code>ReturnType&lt;typeof aggDateRange&gt;</code> |  |
-|  [aggDerivative](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggderivative.md) | <code>ReturnType&lt;typeof aggDerivative&gt;</code> |  |
-|  [aggFilter](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggfilter.md) | <code>ReturnType&lt;typeof aggFilter&gt;</code> |  |
-|  [aggFilteredMetric](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggfilteredmetric.md) | <code>ReturnType&lt;typeof aggFilteredMetric&gt;</code> |  |
-|  [aggFilters](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggfilters.md) | <code>ReturnType&lt;typeof aggFilters&gt;</code> |  |
-|  [aggGeoBounds](./kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeobounds.md) | <code>ReturnType&lt;typeof aggGeoBounds&gt;</code> |  |
-|  [aggGeoCentroid](./kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeocentroid.md) | <code>ReturnType&lt;typeof aggGeoCentroid&gt;</code> |  |
-|  [aggGeoHash](./kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeohash.md) | <code>ReturnType&lt;typeof aggGeoHash&gt;</code> |  |
-|  [aggGeoTile](./kibana-plugin-plugins-data-server.aggfunctionsmapping.agggeotile.md) | <code>ReturnType&lt;typeof aggGeoTile&gt;</code> |  |
-|  [aggHistogram](./kibana-plugin-plugins-data-server.aggfunctionsmapping.agghistogram.md) | <code>ReturnType&lt;typeof aggHistogram&gt;</code> |  |
-|  [aggIpRange](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggiprange.md) | <code>ReturnType&lt;typeof aggIpRange&gt;</code> |  |
-|  [aggMax](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmax.md) | <code>ReturnType&lt;typeof aggMax&gt;</code> |  |
-|  [aggMedian](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmedian.md) | <code>ReturnType&lt;typeof aggMedian&gt;</code> |  |
-|  [aggMin](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmin.md) | <code>ReturnType&lt;typeof aggMin&gt;</code> |  |
-|  [aggMovingAvg](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggmovingavg.md) | <code>ReturnType&lt;typeof aggMovingAvg&gt;</code> |  |
-|  [aggPercentileRanks](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggpercentileranks.md) | <code>ReturnType&lt;typeof aggPercentileRanks&gt;</code> |  |
-|  [aggPercentiles](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggpercentiles.md) | <code>ReturnType&lt;typeof aggPercentiles&gt;</code> |  |
-|  [aggRange](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggrange.md) | <code>ReturnType&lt;typeof aggRange&gt;</code> |  |
-|  [aggSerialDiff](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggserialdiff.md) | <code>ReturnType&lt;typeof aggSerialDiff&gt;</code> |  |
-|  [aggSignificantTerms](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggsignificantterms.md) | <code>ReturnType&lt;typeof aggSignificantTerms&gt;</code> |  |
-|  [aggSinglePercentile](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggsinglepercentile.md) | <code>ReturnType&lt;typeof aggSinglePercentile&gt;</code> |  |
-|  [aggStdDeviation](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggstddeviation.md) | <code>ReturnType&lt;typeof aggStdDeviation&gt;</code> |  |
-|  [aggSum](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggsum.md) | <code>ReturnType&lt;typeof aggSum&gt;</code> |  |
-|  [aggTerms](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggterms.md) | <code>ReturnType&lt;typeof aggTerms&gt;</code> |  |
-|  [aggTopHit](./kibana-plugin-plugins-data-server.aggfunctionsmapping.aggtophit.md) | <code>ReturnType&lt;typeof aggTopHit&gt;</code> |  |
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.agggrouplabels.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.agggrouplabels.md
deleted file mode 100644
index cf0caee6ac33e6..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.agggrouplabels.md
+++ /dev/null
@@ -1,15 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggGroupLabels](./kibana-plugin-plugins-data-server.agggrouplabels.md)
-
-## AggGroupLabels variable
-
-<b>Signature:</b>
-
-```typescript
-AggGroupLabels: {
-    buckets: string;
-    metrics: string;
-    none: string;
-}
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.agggroupname.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.agggroupname.md
deleted file mode 100644
index 403294eba1367c..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.agggroupname.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggGroupName](./kibana-plugin-plugins-data-server.agggroupname.md)
-
-## AggGroupName type
-
-<b>Signature:</b>
-
-```typescript
-export declare type AggGroupName = $Values<typeof AggGroupNames>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.agggroupnames.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.agggroupnames.md
deleted file mode 100644
index 11d194723c5219..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.agggroupnames.md
+++ /dev/null
@@ -1,15 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggGroupNames](./kibana-plugin-plugins-data-server.agggroupnames.md)
-
-## AggGroupNames variable
-
-<b>Signature:</b>
-
-```typescript
-AggGroupNames: Readonly<{
-    Buckets: "buckets";
-    Metrics: "metrics";
-    None: "none";
-}>
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparam.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparam.md
deleted file mode 100644
index 893501666b9a07..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparam.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggParam](./kibana-plugin-plugins-data-server.aggparam.md)
-
-## AggParam type
-
-<b>Signature:</b>
-
-```typescript
-export declare type AggParam = BaseParamType;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamoption.display.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamoption.display.md
deleted file mode 100644
index 1030056e16afe4..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamoption.display.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggParamOption](./kibana-plugin-plugins-data-server.aggparamoption.md) &gt; [display](./kibana-plugin-plugins-data-server.aggparamoption.display.md)
-
-## AggParamOption.display property
-
-<b>Signature:</b>
-
-```typescript
-display: string;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamoption.enabled.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamoption.enabled.md
deleted file mode 100644
index 8b1fcc4a1bbd0e..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamoption.enabled.md
+++ /dev/null
@@ -1,22 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggParamOption](./kibana-plugin-plugins-data-server.aggparamoption.md) &gt; [enabled](./kibana-plugin-plugins-data-server.aggparamoption.enabled.md)
-
-## AggParamOption.enabled() method
-
-<b>Signature:</b>
-
-```typescript
-enabled?(agg: AggConfig): boolean;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  agg | <code>AggConfig</code> |  |
-
-<b>Returns:</b>
-
-`boolean`
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamoption.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamoption.md
deleted file mode 100644
index a7ddcf395cab47..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamoption.md
+++ /dev/null
@@ -1,25 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggParamOption](./kibana-plugin-plugins-data-server.aggparamoption.md)
-
-## AggParamOption interface
-
-<b>Signature:</b>
-
-```typescript
-export interface AggParamOption 
-```
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [display](./kibana-plugin-plugins-data-server.aggparamoption.display.md) | <code>string</code> |  |
-|  [val](./kibana-plugin-plugins-data-server.aggparamoption.val.md) | <code>string</code> |  |
-
-## Methods
-
-|  Method | Description |
-|  --- | --- |
-|  [enabled(agg)](./kibana-plugin-plugins-data-server.aggparamoption.enabled.md) |  |
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamoption.val.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamoption.val.md
deleted file mode 100644
index 2c87c91c294d94..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamoption.val.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggParamOption](./kibana-plugin-plugins-data-server.aggparamoption.md) &gt; [val](./kibana-plugin-plugins-data-server.aggparamoption.val.md)
-
-## AggParamOption.val property
-
-<b>Signature:</b>
-
-```typescript
-val: string;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamtype._constructor_.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamtype._constructor_.md
deleted file mode 100644
index 2e1b16855987e7..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamtype._constructor_.md
+++ /dev/null
@@ -1,20 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggParamType](./kibana-plugin-plugins-data-server.aggparamtype.md) &gt; [(constructor)](./kibana-plugin-plugins-data-server.aggparamtype._constructor_.md)
-
-## AggParamType.(constructor)
-
-Constructs a new instance of the `AggParamType` class
-
-<b>Signature:</b>
-
-```typescript
-constructor(config: Record<string, any>);
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  config | <code>Record&lt;string, any&gt;</code> |  |
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamtype.allowedaggs.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamtype.allowedaggs.md
deleted file mode 100644
index 36179a9ce35697..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamtype.allowedaggs.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggParamType](./kibana-plugin-plugins-data-server.aggparamtype.md) &gt; [allowedAggs](./kibana-plugin-plugins-data-server.aggparamtype.allowedaggs.md)
-
-## AggParamType.allowedAggs property
-
-<b>Signature:</b>
-
-```typescript
-allowedAggs: string[];
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamtype.makeagg.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamtype.makeagg.md
deleted file mode 100644
index bd5d2fca776595..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamtype.makeagg.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggParamType](./kibana-plugin-plugins-data-server.aggparamtype.md) &gt; [makeAgg](./kibana-plugin-plugins-data-server.aggparamtype.makeagg.md)
-
-## AggParamType.makeAgg property
-
-<b>Signature:</b>
-
-```typescript
-makeAgg: (agg: TAggConfig, state?: AggConfigSerialized) => TAggConfig;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamtype.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamtype.md
deleted file mode 100644
index 00c1906dd880bd..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.aggparamtype.md
+++ /dev/null
@@ -1,25 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AggParamType](./kibana-plugin-plugins-data-server.aggparamtype.md)
-
-## AggParamType class
-
-<b>Signature:</b>
-
-```typescript
-export declare class AggParamType<TAggConfig extends IAggConfig = IAggConfig> extends BaseParamType<TAggConfig> 
-```
-
-## Constructors
-
-|  Constructor | Modifiers | Description |
-|  --- | --- | --- |
-|  [(constructor)(config)](./kibana-plugin-plugins-data-server.aggparamtype._constructor_.md) |  | Constructs a new instance of the <code>AggParamType</code> class |
-
-## Properties
-
-|  Property | Modifiers | Type | Description |
-|  --- | --- | --- | --- |
-|  [allowedAggs](./kibana-plugin-plugins-data-server.aggparamtype.allowedaggs.md) |  | <code>string[]</code> |  |
-|  [makeAgg](./kibana-plugin-plugins-data-server.aggparamtype.makeagg.md) |  | <code>(agg: TAggConfig, state?: AggConfigSerialized) =&gt; TAggConfig</code> |  |
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.expiration_time_in_millis.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.expiration_time_in_millis.md
deleted file mode 100644
index eab2fbc6431c6a..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.expiration_time_in_millis.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AsyncSearchResponse](./kibana-plugin-plugins-data-server.asyncsearchresponse.md) &gt; [expiration\_time\_in\_millis](./kibana-plugin-plugins-data-server.asyncsearchresponse.expiration_time_in_millis.md)
-
-## AsyncSearchResponse.expiration\_time\_in\_millis property
-
-<b>Signature:</b>
-
-```typescript
-expiration_time_in_millis: number;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.id.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.id.md
deleted file mode 100644
index d3b61be9b08b35..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.id.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AsyncSearchResponse](./kibana-plugin-plugins-data-server.asyncsearchresponse.md) &gt; [id](./kibana-plugin-plugins-data-server.asyncsearchresponse.id.md)
-
-## AsyncSearchResponse.id property
-
-<b>Signature:</b>
-
-```typescript
-id?: string;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.is_partial.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.is_partial.md
deleted file mode 100644
index 1d1a5ccd1ac69d..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.is_partial.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AsyncSearchResponse](./kibana-plugin-plugins-data-server.asyncsearchresponse.md) &gt; [is\_partial](./kibana-plugin-plugins-data-server.asyncsearchresponse.is_partial.md)
-
-## AsyncSearchResponse.is\_partial property
-
-<b>Signature:</b>
-
-```typescript
-is_partial: boolean;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.is_running.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.is_running.md
deleted file mode 100644
index 17af7a39acfe78..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.is_running.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AsyncSearchResponse](./kibana-plugin-plugins-data-server.asyncsearchresponse.md) &gt; [is\_running](./kibana-plugin-plugins-data-server.asyncsearchresponse.is_running.md)
-
-## AsyncSearchResponse.is\_running property
-
-<b>Signature:</b>
-
-```typescript
-is_running: boolean;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.md
deleted file mode 100644
index 2f11e03f82b5ff..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.md
+++ /dev/null
@@ -1,23 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AsyncSearchResponse](./kibana-plugin-plugins-data-server.asyncsearchresponse.md)
-
-## AsyncSearchResponse interface
-
-<b>Signature:</b>
-
-```typescript
-export interface AsyncSearchResponse<T = unknown> 
-```
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [expiration\_time\_in\_millis](./kibana-plugin-plugins-data-server.asyncsearchresponse.expiration_time_in_millis.md) | <code>number</code> |  |
-|  [id](./kibana-plugin-plugins-data-server.asyncsearchresponse.id.md) | <code>string</code> |  |
-|  [is\_partial](./kibana-plugin-plugins-data-server.asyncsearchresponse.is_partial.md) | <code>boolean</code> |  |
-|  [is\_running](./kibana-plugin-plugins-data-server.asyncsearchresponse.is_running.md) | <code>boolean</code> |  |
-|  [response](./kibana-plugin-plugins-data-server.asyncsearchresponse.response.md) | <code>estypes.SearchResponse&lt;T&gt;</code> |  |
-|  [start\_time\_in\_millis](./kibana-plugin-plugins-data-server.asyncsearchresponse.start_time_in_millis.md) | <code>number</code> |  |
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.response.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.response.md
deleted file mode 100644
index 9370e21542e37b..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.response.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AsyncSearchResponse](./kibana-plugin-plugins-data-server.asyncsearchresponse.md) &gt; [response](./kibana-plugin-plugins-data-server.asyncsearchresponse.response.md)
-
-## AsyncSearchResponse.response property
-
-<b>Signature:</b>
-
-```typescript
-response: estypes.SearchResponse<T>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.start_time_in_millis.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.start_time_in_millis.md
deleted file mode 100644
index 91db5f06d9b2ff..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.asyncsearchresponse.start_time_in_millis.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [AsyncSearchResponse](./kibana-plugin-plugins-data-server.asyncsearchresponse.md) &gt; [start\_time\_in\_millis](./kibana-plugin-plugins-data-server.asyncsearchresponse.start_time_in_millis.md)
-
-## AsyncSearchResponse.start\_time\_in\_millis property
-
-<b>Signature:</b>
-
-```typescript
-start_time_in_millis: number;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.bucket_types.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.bucket_types.md
deleted file mode 100644
index 568e435754545f..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.bucket_types.md
+++ /dev/null
@@ -1,28 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [BUCKET\_TYPES](./kibana-plugin-plugins-data-server.bucket_types.md)
-
-## BUCKET\_TYPES enum
-
-<b>Signature:</b>
-
-```typescript
-export declare enum BUCKET_TYPES 
-```
-
-## Enumeration Members
-
-|  Member | Value | Description |
-|  --- | --- | --- |
-|  DATE\_HISTOGRAM | <code>&quot;date_histogram&quot;</code> |  |
-|  DATE\_RANGE | <code>&quot;date_range&quot;</code> |  |
-|  FILTER | <code>&quot;filter&quot;</code> |  |
-|  FILTERS | <code>&quot;filters&quot;</code> |  |
-|  GEOHASH\_GRID | <code>&quot;geohash_grid&quot;</code> |  |
-|  GEOTILE\_GRID | <code>&quot;geotile_grid&quot;</code> |  |
-|  HISTOGRAM | <code>&quot;histogram&quot;</code> |  |
-|  IP\_RANGE | <code>&quot;ip_range&quot;</code> |  |
-|  RANGE | <code>&quot;range&quot;</code> |  |
-|  SIGNIFICANT\_TERMS | <code>&quot;significant_terms&quot;</code> |  |
-|  TERMS | <code>&quot;terms&quot;</code> |  |
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.buildqueryfromfilters.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.buildqueryfromfilters.md
deleted file mode 100644
index 83cbcd016f92a7..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.buildqueryfromfilters.md
+++ /dev/null
@@ -1,21 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [buildQueryFromFilters](./kibana-plugin-plugins-data-server.buildqueryfromfilters.md)
-
-## buildQueryFromFilters variable
-
-> Warning: This API is now obsolete.
-> 
-> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
-> 
-
-<b>Signature:</b>
-
-```typescript
-buildQueryFromFilters: (filters: oldFilter[] | undefined, indexPattern: import("@kbn/es-query").IndexPatternBase | undefined, ignoreFilterIfFieldNotInIndex?: boolean | undefined) => {
-    must: never[];
-    filter: oldFilter[];
-    should: never[];
-    must_not: oldFilter[];
-}
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.castestokbnfieldtypename.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.castestokbnfieldtypename.md
index 834fe302ad9f8d..a3f92491e8983c 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.castestokbnfieldtypename.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.castestokbnfieldtypename.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import from the "<!-- -->@<!-- -->kbn/field-types" package directly instead.  8.0
+> Import from the "<!-- -->@<!-- -->kbn/field-types" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.esaggsexpressionfunctiondefinition.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.esaggsexpressionfunctiondefinition.md
deleted file mode 100644
index 572c4e0c1eb2fe..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.esaggsexpressionfunctiondefinition.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [EsaggsExpressionFunctionDefinition](./kibana-plugin-plugins-data-server.esaggsexpressionfunctiondefinition.md)
-
-## EsaggsExpressionFunctionDefinition type
-
-<b>Signature:</b>
-
-```typescript
-export declare type EsaggsExpressionFunctionDefinition = ExpressionFunctionDefinition<'esaggs', Input, Arguments, Output>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.executioncontextsearch.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.executioncontextsearch.md
deleted file mode 100644
index 2f94dbe970d44b..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.executioncontextsearch.md
+++ /dev/null
@@ -1,15 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [ExecutionContextSearch](./kibana-plugin-plugins-data-server.executioncontextsearch.md)
-
-## ExecutionContextSearch type
-
-<b>Signature:</b>
-
-```typescript
-export declare type ExecutionContextSearch = {
-    filters?: Filter[];
-    query?: Query | Query[];
-    timeRange?: TimeRange;
-};
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.expressionfunctionkibana.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.expressionfunctionkibana.md
deleted file mode 100644
index d80ff78dd803cf..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.expressionfunctionkibana.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [ExpressionFunctionKibana](./kibana-plugin-plugins-data-server.expressionfunctionkibana.md)
-
-## ExpressionFunctionKibana type
-
-<b>Signature:</b>
-
-```typescript
-export declare type ExpressionFunctionKibana = ExpressionFunctionDefinition<'kibana', ExpressionValueSearchContext | null, object, ExpressionValueSearchContext, ExecutionContext<Adapters, ExecutionContextSearch>>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.expressionfunctionkibanacontext.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.expressionfunctionkibanacontext.md
deleted file mode 100644
index b67f7b8c4b60d0..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.expressionfunctionkibanacontext.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [ExpressionFunctionKibanaContext](./kibana-plugin-plugins-data-server.expressionfunctionkibanacontext.md)
-
-## ExpressionFunctionKibanaContext type
-
-<b>Signature:</b>
-
-```typescript
-export declare type ExpressionFunctionKibanaContext = ExpressionFunctionDefinition<'kibana_context', KibanaContext | null, Arguments, Promise<KibanaContext>, ExecutionContext<Adapters, ExecutionContextSearch>>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.expressionvaluesearchcontext.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.expressionvaluesearchcontext.md
deleted file mode 100644
index 8015482ddec1e0..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.expressionvaluesearchcontext.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [ExpressionValueSearchContext](./kibana-plugin-plugins-data-server.expressionvaluesearchcontext.md)
-
-## ExpressionValueSearchContext type
-
-<b>Signature:</b>
-
-```typescript
-export declare type ExpressionValueSearchContext = ExpressionValueBoxed<'kibana_context', ExecutionContextSearch>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.fieldformatconfig.es.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.fieldformatconfig.es.md
deleted file mode 100644
index a3c3ddc4e1649b..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.fieldformatconfig.es.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [FieldFormatConfig](./kibana-plugin-plugins-data-server.fieldformatconfig.md) &gt; [es](./kibana-plugin-plugins-data-server.fieldformatconfig.es.md)
-
-## FieldFormatConfig.es property
-
-<b>Signature:</b>
-
-```typescript
-es?: boolean;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.fieldformatconfig.id.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.fieldformatconfig.id.md
deleted file mode 100644
index c5173fba225331..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.fieldformatconfig.id.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [FieldFormatConfig](./kibana-plugin-plugins-data-server.fieldformatconfig.md) &gt; [id](./kibana-plugin-plugins-data-server.fieldformatconfig.id.md)
-
-## FieldFormatConfig.id property
-
-<b>Signature:</b>
-
-```typescript
-id: FieldFormatId;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.fieldformatconfig.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.fieldformatconfig.md
deleted file mode 100644
index 5d5c13784bc57d..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.fieldformatconfig.md
+++ /dev/null
@@ -1,20 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [FieldFormatConfig](./kibana-plugin-plugins-data-server.fieldformatconfig.md)
-
-## FieldFormatConfig interface
-
-<b>Signature:</b>
-
-```typescript
-export interface FieldFormatConfig 
-```
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [es](./kibana-plugin-plugins-data-server.fieldformatconfig.es.md) | <code>boolean</code> |  |
-|  [id](./kibana-plugin-plugins-data-server.fieldformatconfig.id.md) | <code>FieldFormatId</code> |  |
-|  [params](./kibana-plugin-plugins-data-server.fieldformatconfig.params.md) | <code>Record&lt;string, any&gt;</code> |  |
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.fieldformatconfig.params.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.fieldformatconfig.params.md
deleted file mode 100644
index c5e5faef308600..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.fieldformatconfig.params.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [FieldFormatConfig](./kibana-plugin-plugins-data-server.fieldformatconfig.md) &gt; [params](./kibana-plugin-plugins-data-server.fieldformatconfig.params.md)
-
-## FieldFormatConfig.params property
-
-<b>Signature:</b>
-
-```typescript
-params: Record<string, any>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.fieldformats.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.fieldformats.md
deleted file mode 100644
index 42563051bcdc4b..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.fieldformats.md
+++ /dev/null
@@ -1,28 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [fieldFormats](./kibana-plugin-plugins-data-server.fieldformats.md)
-
-## fieldFormats variable
-
-<b>Signature:</b>
-
-```typescript
-fieldFormats: {
-    FieldFormatsRegistry: typeof FieldFormatsRegistry;
-    FieldFormat: typeof FieldFormat;
-    BoolFormat: typeof BoolFormat;
-    BytesFormat: typeof BytesFormat;
-    ColorFormat: typeof ColorFormat;
-    DurationFormat: typeof DurationFormat;
-    IpFormat: typeof IpFormat;
-    NumberFormat: typeof NumberFormat;
-    PercentFormat: typeof PercentFormat;
-    RelativeDateFormat: typeof RelativeDateFormat;
-    SourceFormat: typeof SourceFormat;
-    StaticLookupFormat: typeof StaticLookupFormat;
-    UrlFormat: typeof UrlFormat;
-    StringFormat: typeof StringFormat;
-    TruncateFormat: typeof TruncateFormat;
-    HistogramFormat: typeof HistogramFormat;
-}
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.fieldformatsgetconfigfn.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.fieldformatsgetconfigfn.md
deleted file mode 100644
index a3f6c709246ea2..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.fieldformatsgetconfigfn.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [FieldFormatsGetConfigFn](./kibana-plugin-plugins-data-server.fieldformatsgetconfigfn.md)
-
-## FieldFormatsGetConfigFn type
-
-<b>Signature:</b>
-
-```typescript
-export declare type FieldFormatsGetConfigFn = GetConfigFn;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.getdefaultsearchparams.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.getdefaultsearchparams.md
deleted file mode 100644
index 19a4bbbbef86cf..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.getdefaultsearchparams.md
+++ /dev/null
@@ -1,22 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [getDefaultSearchParams](./kibana-plugin-plugins-data-server.getdefaultsearchparams.md)
-
-## getDefaultSearchParams() function
-
-<b>Signature:</b>
-
-```typescript
-export declare function getDefaultSearchParams(uiSettingsClient: IUiSettingsClient): Promise<Pick<Search, 'max_concurrent_shard_requests' | 'ignore_unavailable' | 'track_total_hits'>>;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  uiSettingsClient | <code>IUiSettingsClient</code> |  |
-
-<b>Returns:</b>
-
-`Promise<Pick<Search, 'max_concurrent_shard_requests' | 'ignore_unavailable' | 'track_total_hits'>>`
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.getshardtimeout.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.getshardtimeout.md
deleted file mode 100644
index 87aa32608eb14e..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.getshardtimeout.md
+++ /dev/null
@@ -1,22 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [getShardTimeout](./kibana-plugin-plugins-data-server.getshardtimeout.md)
-
-## getShardTimeout() function
-
-<b>Signature:</b>
-
-```typescript
-export declare function getShardTimeout(config: SharedGlobalConfig): Pick<Search, 'timeout'>;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  config | <code>SharedGlobalConfig</code> |  |
-
-<b>Returns:</b>
-
-`Pick<Search, 'timeout'>`
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.iaggconfig.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.iaggconfig.md
deleted file mode 100644
index 261b6e0b3bac11..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.iaggconfig.md
+++ /dev/null
@@ -1,15 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [IAggConfig](./kibana-plugin-plugins-data-server.iaggconfig.md)
-
-## IAggConfig type
-
- AggConfig
-
- This class represents an aggregation, which is displayed in the left-hand nav of the Visualize app.
-
-<b>Signature:</b>
-
-```typescript
-export declare type IAggConfig = AggConfig;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.iaggtype.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.iaggtype.md
deleted file mode 100644
index d5868e1b0917e0..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.iaggtype.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [IAggType](./kibana-plugin-plugins-data-server.iaggtype.md)
-
-## IAggType type
-
-<b>Signature:</b>
-
-```typescript
-export declare type IAggType = AggType;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldformatsregistry.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldformatsregistry.md
deleted file mode 100644
index c284d2c87fcaa2..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldformatsregistry.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [IFieldFormatsRegistry](./kibana-plugin-plugins-data-server.ifieldformatsregistry.md)
-
-## IFieldFormatsRegistry type
-
-<b>Signature:</b>
-
-```typescript
-declare type IFieldFormatsRegistry = PublicMethodsOf<FieldFormatsRegistry>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldparamtype.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldparamtype.md
deleted file mode 100644
index 4937245647f4ed..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldparamtype.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [IFieldParamType](./kibana-plugin-plugins-data-server.ifieldparamtype.md)
-
-## IFieldParamType type
-
-<b>Signature:</b>
-
-```typescript
-export declare type IFieldParamType = FieldParamType;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldsubtype.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldsubtype.md
index 9ac9ba1abc637c..7f812fb08fd51a 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldsubtype.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldsubtype.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.0
+> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.md
index 932afceb5d22bb..93f91f6264dbca 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ifieldtype.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Use [IndexPatternField](./kibana-plugin-plugins-data-server.indexpatternfield.md)  8.0
+> Use [IndexPatternField](./kibana-plugin-plugins-data-server.indexpatternfield.md)  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.imetricaggtype.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.imetricaggtype.md
deleted file mode 100644
index ae779c2b1510f1..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.imetricaggtype.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [IMetricAggType](./kibana-plugin-plugins-data-server.imetricaggtype.md)
-
-## IMetricAggType type
-
-<b>Signature:</b>
-
-```typescript
-export declare type IMetricAggType = MetricAggType;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.addscriptedfield.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.addscriptedfield.md
index 9fe169233af13d..829cc9c0752a08 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.addscriptedfield.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.addscriptedfield.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> use runtime field instead  8.0
+> use runtime field instead  8.1
 > 
 
 Add scripted field to field list
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.getnonscriptedfields.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.getnonscriptedfields.md
index 8a06b394ae5549..deb71a9df8cc59 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.getnonscriptedfields.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.getnonscriptedfields.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> use runtime field instead  8.0
+> use runtime field instead  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.getscriptedfields.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.getscriptedfields.md
index 15978b64149479..3beef6e08ed3f9 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.getscriptedfields.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.getscriptedfields.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> use runtime field instead  8.0
+> use runtime field instead  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.intervalname.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.intervalname.md
index e2810cc21a378e..01367d931a841a 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.intervalname.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.intervalname.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Used by time range index patterns  8.0
+> Used by time range index patterns  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.removescriptedfield.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.removescriptedfield.md
index bc96d3596ed12e..c72ad5163d4ec1 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.removescriptedfield.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpattern.removescriptedfield.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> use runtime field instead  8.0
+> use runtime field instead  8.1
 > 
 
 Remove scripted field from field list
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpatternloadexpressionfunctiondefinition.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpatternloadexpressionfunctiondefinition.md
deleted file mode 100644
index c54802aa42e25a..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpatternloadexpressionfunctiondefinition.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [IndexPatternLoadExpressionFunctionDefinition](./kibana-plugin-plugins-data-server.indexpatternloadexpressionfunctiondefinition.md)
-
-## IndexPatternLoadExpressionFunctionDefinition type
-
-<b>Signature:</b>
-
-```typescript
-export declare type IndexPatternLoadExpressionFunctionDefinition = ExpressionFunctionDefinition<typeof name, Input, Arguments, Output>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpatterns.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpatterns.md
deleted file mode 100644
index 935d7fbacf946a..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpatterns.md
+++ /dev/null
@@ -1,14 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [indexPatterns](./kibana-plugin-plugins-data-server.indexpatterns.md)
-
-## indexPatterns variable
-
-<b>Signature:</b>
-
-```typescript
-indexPatterns: {
-    isFilterable: typeof isFilterable;
-    isNestedField: typeof isNestedField;
-}
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpatternsserviceprovider.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpatternsserviceprovider.md
deleted file mode 100644
index b5c7d8931ad4b8..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpatternsserviceprovider.md
+++ /dev/null
@@ -1,19 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [IndexPatternsServiceProvider](./kibana-plugin-plugins-data-server.indexpatternsserviceprovider.md)
-
-## IndexPatternsServiceProvider class
-
-<b>Signature:</b>
-
-```typescript
-export declare class IndexPatternsServiceProvider implements Plugin<void, IndexPatternsServiceStart> 
-```
-
-## Methods
-
-|  Method | Modifiers | Description |
-|  --- | --- | --- |
-|  [setup(core, { expressions, usageCollection })](./kibana-plugin-plugins-data-server.indexpatternsserviceprovider.setup.md) |  |  |
-|  [start(core, { fieldFormats, logger })](./kibana-plugin-plugins-data-server.indexpatternsserviceprovider.start.md) |  |  |
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpatternsserviceprovider.setup.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpatternsserviceprovider.setup.md
deleted file mode 100644
index aadd32b54b294b..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpatternsserviceprovider.setup.md
+++ /dev/null
@@ -1,23 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [IndexPatternsServiceProvider](./kibana-plugin-plugins-data-server.indexpatternsserviceprovider.md) &gt; [setup](./kibana-plugin-plugins-data-server.indexpatternsserviceprovider.setup.md)
-
-## IndexPatternsServiceProvider.setup() method
-
-<b>Signature:</b>
-
-```typescript
-setup(core: CoreSetup<IndexPatternsServiceStartDeps, DataPluginStart>, { expressions, usageCollection }: IndexPatternsServiceSetupDeps): void;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  core | <code>CoreSetup&lt;IndexPatternsServiceStartDeps, DataPluginStart&gt;</code> |  |
-|  { expressions, usageCollection } | <code>IndexPatternsServiceSetupDeps</code> |  |
-
-<b>Returns:</b>
-
-`void`
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpatternsserviceprovider.start.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpatternsserviceprovider.start.md
deleted file mode 100644
index 7559695a0a3316..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.indexpatternsserviceprovider.start.md
+++ /dev/null
@@ -1,27 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [IndexPatternsServiceProvider](./kibana-plugin-plugins-data-server.indexpatternsserviceprovider.md) &gt; [start](./kibana-plugin-plugins-data-server.indexpatternsserviceprovider.start.md)
-
-## IndexPatternsServiceProvider.start() method
-
-<b>Signature:</b>
-
-```typescript
-start(core: CoreStart, { fieldFormats, logger }: IndexPatternsServiceStartDeps): {
-        indexPatternsServiceFactory: (savedObjectsClient: Pick<import("../../../../core/server").SavedObjectsClient, "update" | "get" | "delete" | "create" | "bulkCreate" | "checkConflicts" | "find" | "bulkGet" | "resolve" | "collectMultiNamespaceReferences" | "updateObjectsSpaces" | "bulkUpdate" | "removeReferencesTo" | "openPointInTimeForType" | "closePointInTime" | "createPointInTimeFinder" | "errors">, elasticsearchClient: ElasticsearchClient) => Promise<IndexPatternsCommonService>;
-    };
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  core | <code>CoreStart</code> |  |
-|  { fieldFormats, logger } | <code>IndexPatternsServiceStartDeps</code> |  |
-
-<b>Returns:</b>
-
-`{
-        indexPatternsServiceFactory: (savedObjectsClient: Pick<import("../../../../core/server").SavedObjectsClient, "update" | "get" | "delete" | "create" | "bulkCreate" | "checkConflicts" | "find" | "bulkGet" | "resolve" | "collectMultiNamespaceReferences" | "updateObjectsSpaces" | "bulkUpdate" | "removeReferencesTo" | "openPointInTimeForType" | "closePointInTime" | "createPointInTimeFinder" | "errors">, elasticsearchClient: ElasticsearchClient) => Promise<IndexPatternsCommonService>;
-    }`
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchsetup.aggs.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchsetup.aggs.md
deleted file mode 100644
index 86bd4ab694e113..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchsetup.aggs.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [ISearchSetup](./kibana-plugin-plugins-data-server.isearchsetup.md) &gt; [aggs](./kibana-plugin-plugins-data-server.isearchsetup.aggs.md)
-
-## ISearchSetup.aggs property
-
-<b>Signature:</b>
-
-```typescript
-aggs: AggsSetup;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchsetup.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchsetup.md
deleted file mode 100644
index 3e27140e8bc089..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchsetup.md
+++ /dev/null
@@ -1,20 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [ISearchSetup](./kibana-plugin-plugins-data-server.isearchsetup.md)
-
-## ISearchSetup interface
-
-<b>Signature:</b>
-
-```typescript
-export interface ISearchSetup 
-```
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [aggs](./kibana-plugin-plugins-data-server.isearchsetup.aggs.md) | <code>AggsSetup</code> |  |
-|  [registerSearchStrategy](./kibana-plugin-plugins-data-server.isearchsetup.registersearchstrategy.md) | <code>&lt;SearchStrategyRequest extends IKibanaSearchRequest = IEsSearchRequest, SearchStrategyResponse extends IKibanaSearchResponse = IEsSearchResponse&gt;(name: string, strategy: ISearchStrategy&lt;SearchStrategyRequest, SearchStrategyResponse&gt;) =&gt; void</code> | Extension point exposed for other plugins to register their own search strategies. |
-|  [usage](./kibana-plugin-plugins-data-server.isearchsetup.usage.md) | <code>SearchUsage</code> | Used internally for telemetry |
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchsetup.registersearchstrategy.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchsetup.registersearchstrategy.md
deleted file mode 100644
index 81571d343495c2..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchsetup.registersearchstrategy.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [ISearchSetup](./kibana-plugin-plugins-data-server.isearchsetup.md) &gt; [registerSearchStrategy](./kibana-plugin-plugins-data-server.isearchsetup.registersearchstrategy.md)
-
-## ISearchSetup.registerSearchStrategy property
-
-Extension point exposed for other plugins to register their own search strategies.
-
-<b>Signature:</b>
-
-```typescript
-registerSearchStrategy: <SearchStrategyRequest extends IKibanaSearchRequest = IEsSearchRequest, SearchStrategyResponse extends IKibanaSearchResponse = IEsSearchResponse>(name: string, strategy: ISearchStrategy<SearchStrategyRequest, SearchStrategyResponse>) => void;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchsetup.usage.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchsetup.usage.md
deleted file mode 100644
index 1a94a709cc214a..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchsetup.usage.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [ISearchSetup](./kibana-plugin-plugins-data-server.isearchsetup.md) &gt; [usage](./kibana-plugin-plugins-data-server.isearchsetup.usage.md)
-
-## ISearchSetup.usage property
-
-Used internally for telemetry
-
-<b>Signature:</b>
-
-```typescript
-usage?: SearchUsage;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.aggs.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.aggs.md
deleted file mode 100644
index 8da429a07708c8..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.aggs.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [ISearchStart](./kibana-plugin-plugins-data-server.isearchstart.md) &gt; [aggs](./kibana-plugin-plugins-data-server.isearchstart.aggs.md)
-
-## ISearchStart.aggs property
-
-<b>Signature:</b>
-
-```typescript
-aggs: AggsStart;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.asscoped.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.asscoped.md
deleted file mode 100644
index 1c65aeb8f137fd..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.asscoped.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [ISearchStart](./kibana-plugin-plugins-data-server.isearchstart.md) &gt; [asScoped](./kibana-plugin-plugins-data-server.isearchstart.asscoped.md)
-
-## ISearchStart.asScoped property
-
-<b>Signature:</b>
-
-```typescript
-asScoped: (request: KibanaRequest) => IScopedSearchClient;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.getsearchstrategy.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.getsearchstrategy.md
deleted file mode 100644
index 9820e281c3f93f..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.getsearchstrategy.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [ISearchStart](./kibana-plugin-plugins-data-server.isearchstart.md) &gt; [getSearchStrategy](./kibana-plugin-plugins-data-server.isearchstart.getsearchstrategy.md)
-
-## ISearchStart.getSearchStrategy property
-
-Get other registered search strategies by name (or, by default, the Elasticsearch strategy). For example, if a new strategy needs to use the already-registered ES search strategy, it can use this function to accomplish that.
-
-<b>Signature:</b>
-
-```typescript
-getSearchStrategy: (name?: string) => ISearchStrategy<SearchStrategyRequest, SearchStrategyResponse>;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.md
deleted file mode 100644
index 5a1b0cd2653002..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.md
+++ /dev/null
@@ -1,22 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [ISearchStart](./kibana-plugin-plugins-data-server.isearchstart.md)
-
-## ISearchStart interface
-
-<b>Signature:</b>
-
-```typescript
-export interface ISearchStart<SearchStrategyRequest extends IKibanaSearchRequest = IEsSearchRequest, SearchStrategyResponse extends IKibanaSearchResponse = IEsSearchResponse> 
-```
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [aggs](./kibana-plugin-plugins-data-server.isearchstart.aggs.md) | <code>AggsStart</code> |  |
-|  [asScoped](./kibana-plugin-plugins-data-server.isearchstart.asscoped.md) | <code>(request: KibanaRequest) =&gt; IScopedSearchClient</code> |  |
-|  [getSearchStrategy](./kibana-plugin-plugins-data-server.isearchstart.getsearchstrategy.md) | <code>(name?: string) =&gt; ISearchStrategy&lt;SearchStrategyRequest, SearchStrategyResponse&gt;</code> | Get other registered search strategies by name (or, by default, the Elasticsearch strategy). For example, if a new strategy needs to use the already-registered ES search strategy, it can use this function to accomplish that. |
-|  [searchAsInternalUser](./kibana-plugin-plugins-data-server.isearchstart.searchasinternaluser.md) | <code>ISearchStrategy</code> | Search as the internal Kibana system user. This is not a registered search strategy as we don't want to allow access from the client. |
-|  [searchSource](./kibana-plugin-plugins-data-server.isearchstart.searchsource.md) | <code>{</code><br/><code>        asScoped: (request: KibanaRequest) =&gt; Promise&lt;ISearchStartSearchSource&gt;;</code><br/><code>    }</code> |  |
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.searchasinternaluser.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.searchasinternaluser.md
deleted file mode 100644
index f6a18dafc85180..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.searchasinternaluser.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [ISearchStart](./kibana-plugin-plugins-data-server.isearchstart.md) &gt; [searchAsInternalUser](./kibana-plugin-plugins-data-server.isearchstart.searchasinternaluser.md)
-
-## ISearchStart.searchAsInternalUser property
-
-Search as the internal Kibana system user. This is not a registered search strategy as we don't want to allow access from the client.
-
-<b>Signature:</b>
-
-```typescript
-searchAsInternalUser: ISearchStrategy;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.searchsource.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.searchsource.md
deleted file mode 100644
index 66a43fe29c43bb..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.isearchstart.searchsource.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [ISearchStart](./kibana-plugin-plugins-data-server.isearchstart.md) &gt; [searchSource](./kibana-plugin-plugins-data-server.isearchstart.searchsource.md)
-
-## ISearchStart.searchSource property
-
-<b>Signature:</b>
-
-```typescript
-searchSource: {
-        asScoped: (request: KibanaRequest) => Promise<ISearchStartSearchSource>;
-    };
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.kibanacontext.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.kibanacontext.md
deleted file mode 100644
index 1ddc43c633b266..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.kibanacontext.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [KibanaContext](./kibana-plugin-plugins-data-server.kibanacontext.md)
-
-## KibanaContext type
-
-<b>Signature:</b>
-
-```typescript
-export declare type KibanaContext = ExpressionValueSearchContext;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.kuerynode.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.kuerynode.md
index 0bdb5d6726fa83..f56300757736ac 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.kuerynode.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.kuerynode.md
@@ -6,7 +6,7 @@
 
 > Warning: This API is now obsolete.
 > 
-> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.0
+> Import from the "<!-- -->@<!-- -->kbn/es-query" package directly instead.  8.1
 > 
 
 <b>Signature:</b>
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.md
index 2e76e3b0c6ad4d..9c3d0f6f41d0ac 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.md
@@ -8,21 +8,17 @@
 
 |  Class | Description |
 |  --- | --- |
-|  [AggParamType](./kibana-plugin-plugins-data-server.aggparamtype.md) |  |
 |  [IndexPattern](./kibana-plugin-plugins-data-server.indexpattern.md) |  |
 |  [IndexPatternField](./kibana-plugin-plugins-data-server.indexpatternfield.md) |  |
 |  [IndexPatternsFetcher](./kibana-plugin-plugins-data-server.indexpatternsfetcher.md) |  |
 |  [IndexPatternsService](./kibana-plugin-plugins-data-server.indexpatternsservice.md) |  |
-|  [IndexPatternsServiceProvider](./kibana-plugin-plugins-data-server.indexpatternsserviceprovider.md) |  |
 |  [NoSearchIdInSessionError](./kibana-plugin-plugins-data-server.nosearchidinsessionerror.md) |  |
-|  [OptionedParamType](./kibana-plugin-plugins-data-server.optionedparamtype.md) |  |
 |  [Plugin](./kibana-plugin-plugins-data-server.plugin.md) |  |
 
 ## Enumerations
 
 |  Enumeration | Description |
 |  --- | --- |
-|  [BUCKET\_TYPES](./kibana-plugin-plugins-data-server.bucket_types.md) |  |
 |  [METRIC\_TYPES](./kibana-plugin-plugins-data-server.metric_types.md) |  |
 
 ## Functions
@@ -30,49 +26,33 @@
 |  Function | Description |
 |  --- | --- |
 |  [getCapabilitiesForRollupIndices(indices)](./kibana-plugin-plugins-data-server.getcapabilitiesforrollupindices.md) |  |
-|  [getDefaultSearchParams(uiSettingsClient)](./kibana-plugin-plugins-data-server.getdefaultsearchparams.md) |  |
 |  [getEsQueryConfig(config)](./kibana-plugin-plugins-data-server.getesqueryconfig.md) |  |
-|  [getShardTimeout(config)](./kibana-plugin-plugins-data-server.getshardtimeout.md) |  |
 |  [getTime(indexPattern, timeRange, options)](./kibana-plugin-plugins-data-server.gettime.md) |  |
 |  [parseInterval(interval)](./kibana-plugin-plugins-data-server.parseinterval.md) |  |
 |  [plugin(initializerContext)](./kibana-plugin-plugins-data-server.plugin.md) | Static code to be shared externally |
-|  [searchUsageObserver(logger, usage, { isRestore })](./kibana-plugin-plugins-data-server.searchusageobserver.md) | Rxjs observer for easily doing <code>tap(searchUsageObserver(logger, usage))</code> in an rxjs chain. |
 |  [shouldReadFieldFromDocValues(aggregatable, esType)](./kibana-plugin-plugins-data-server.shouldreadfieldfromdocvalues.md) |  |
-|  [usageProvider(core)](./kibana-plugin-plugins-data-server.usageprovider.md) |  |
 
 ## Interfaces
 
 |  Interface | Description |
 |  --- | --- |
-|  [AggFunctionsMapping](./kibana-plugin-plugins-data-server.aggfunctionsmapping.md) | A global list of the expression function definitions for each agg type function. |
-|  [AggParamOption](./kibana-plugin-plugins-data-server.aggparamoption.md) |  |
-|  [AsyncSearchResponse](./kibana-plugin-plugins-data-server.asyncsearchresponse.md) |  |
 |  [AsyncSearchStatusResponse](./kibana-plugin-plugins-data-server.asyncsearchstatusresponse.md) |  |
 |  [FieldDescriptor](./kibana-plugin-plugins-data-server.fielddescriptor.md) |  |
-|  [FieldFormatConfig](./kibana-plugin-plugins-data-server.fieldformatconfig.md) |  |
 |  [IEsSearchRequest](./kibana-plugin-plugins-data-server.iessearchrequest.md) |  |
 |  [IFieldType](./kibana-plugin-plugins-data-server.ifieldtype.md) |  |
 |  [IndexPatternAttributes](./kibana-plugin-plugins-data-server.indexpatternattributes.md) | Interface for an index pattern saved object |
 |  [IScopedSearchClient](./kibana-plugin-plugins-data-server.iscopedsearchclient.md) |  |
 |  [ISearchOptions](./kibana-plugin-plugins-data-server.isearchoptions.md) |  |
 |  [ISearchSessionService](./kibana-plugin-plugins-data-server.isearchsessionservice.md) |  |
-|  [ISearchSetup](./kibana-plugin-plugins-data-server.isearchsetup.md) |  |
-|  [ISearchStart](./kibana-plugin-plugins-data-server.isearchstart.md) |  |
 |  [ISearchStrategy](./kibana-plugin-plugins-data-server.isearchstrategy.md) | Search strategy interface contains a search method that takes in a request and returns a promise that resolves to a response. |
-|  [OptionedValueProp](./kibana-plugin-plugins-data-server.optionedvalueprop.md) |  |
 |  [PluginSetup](./kibana-plugin-plugins-data-server.pluginsetup.md) |  |
 |  [PluginStart](./kibana-plugin-plugins-data-server.pluginstart.md) |  |
-|  [RefreshInterval](./kibana-plugin-plugins-data-server.refreshinterval.md) |  |
 |  [SearchStrategyDependencies](./kibana-plugin-plugins-data-server.searchstrategydependencies.md) |  |
-|  [SearchUsage](./kibana-plugin-plugins-data-server.searchusage.md) |  |
 
 ## Variables
 
 |  Variable | Description |
 |  --- | --- |
-|  [AggGroupLabels](./kibana-plugin-plugins-data-server.agggrouplabels.md) |  |
-|  [AggGroupNames](./kibana-plugin-plugins-data-server.agggroupnames.md) |  |
-|  [buildQueryFromFilters](./kibana-plugin-plugins-data-server.buildqueryfromfilters.md) |  |
 |  [castEsToKbnFieldTypeName](./kibana-plugin-plugins-data-server.castestokbnfieldtypename.md) |  |
 |  [config](./kibana-plugin-plugins-data-server.config.md) |  |
 |  [ES\_SEARCH\_STRATEGY](./kibana-plugin-plugins-data-server.es_search_strategy.md) |  |
@@ -80,10 +60,7 @@
 |  [esKuery](./kibana-plugin-plugins-data-server.eskuery.md) |  |
 |  [esQuery](./kibana-plugin-plugins-data-server.esquery.md) |  |
 |  [exporters](./kibana-plugin-plugins-data-server.exporters.md) |  |
-|  [fieldFormats](./kibana-plugin-plugins-data-server.fieldformats.md) |  |
 |  [INDEX\_PATTERN\_SAVED\_OBJECT\_TYPE](./kibana-plugin-plugins-data-server.index_pattern_saved_object_type.md) | \* |
-|  [indexPatterns](./kibana-plugin-plugins-data-server.indexpatterns.md) |  |
-|  [mergeCapabilitiesWithFields](./kibana-plugin-plugins-data-server.mergecapabilitieswithfields.md) |  |
 |  [search](./kibana-plugin-plugins-data-server.search.md) |  |
 |  [UI\_SETTINGS](./kibana-plugin-plugins-data-server.ui_settings.md) |  |
 
@@ -91,26 +68,10 @@
 
 |  Type Alias | Description |
 |  --- | --- |
-|  [AggConfigOptions](./kibana-plugin-plugins-data-server.aggconfigoptions.md) |  |
-|  [AggGroupName](./kibana-plugin-plugins-data-server.agggroupname.md) |  |
-|  [AggParam](./kibana-plugin-plugins-data-server.aggparam.md) |  |
-|  [EsaggsExpressionFunctionDefinition](./kibana-plugin-plugins-data-server.esaggsexpressionfunctiondefinition.md) |  |
 |  [EsQueryConfig](./kibana-plugin-plugins-data-server.esqueryconfig.md) |  |
-|  [ExecutionContextSearch](./kibana-plugin-plugins-data-server.executioncontextsearch.md) |  |
-|  [ExpressionFunctionKibana](./kibana-plugin-plugins-data-server.expressionfunctionkibana.md) |  |
-|  [ExpressionFunctionKibanaContext](./kibana-plugin-plugins-data-server.expressionfunctionkibanacontext.md) |  |
-|  [ExpressionValueSearchContext](./kibana-plugin-plugins-data-server.expressionvaluesearchcontext.md) |  |
-|  [FieldFormatsGetConfigFn](./kibana-plugin-plugins-data-server.fieldformatsgetconfigfn.md) |  |
 |  [Filter](./kibana-plugin-plugins-data-server.filter.md) |  |
-|  [IAggConfig](./kibana-plugin-plugins-data-server.iaggconfig.md) |  AggConfig This class represents an aggregation, which is displayed in the left-hand nav of the Visualize app. |
-|  [IAggType](./kibana-plugin-plugins-data-server.iaggtype.md) |  |
 |  [IEsSearchResponse](./kibana-plugin-plugins-data-server.iessearchresponse.md) |  |
-|  [IFieldFormatsRegistry](./kibana-plugin-plugins-data-server.ifieldformatsregistry.md) |  |
-|  [IFieldParamType](./kibana-plugin-plugins-data-server.ifieldparamtype.md) |  |
 |  [IFieldSubType](./kibana-plugin-plugins-data-server.ifieldsubtype.md) |  |
-|  [IMetricAggType](./kibana-plugin-plugins-data-server.imetricaggtype.md) |  |
-|  [IndexPatternLoadExpressionFunctionDefinition](./kibana-plugin-plugins-data-server.indexpatternloadexpressionfunctiondefinition.md) |  |
-|  [KibanaContext](./kibana-plugin-plugins-data-server.kibanacontext.md) |  |
 |  [KueryNode](./kibana-plugin-plugins-data-server.kuerynode.md) |  |
 |  [ParsedInterval](./kibana-plugin-plugins-data-server.parsedinterval.md) |  |
 |  [SearchRequestHandlerContext](./kibana-plugin-plugins-data-server.searchrequesthandlercontext.md) |  |
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.mergecapabilitieswithfields.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.mergecapabilitieswithfields.md
deleted file mode 100644
index 4befc100c10894..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.mergecapabilitieswithfields.md
+++ /dev/null
@@ -1,13 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [mergeCapabilitiesWithFields](./kibana-plugin-plugins-data-server.mergecapabilitieswithfields.md)
-
-## mergeCapabilitiesWithFields variable
-
-<b>Signature:</b>
-
-```typescript
-mergeCapabilitiesWithFields: (rollupIndexCapabilities: {
-    [key: string]: any;
-}, fieldsFromFieldCapsApi: Record<string, FieldDescriptor>, previousFields?: FieldDescriptor[]) => FieldDescriptor[]
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedparamtype._constructor_.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedparamtype._constructor_.md
deleted file mode 100644
index 3b2fd2218709ae..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedparamtype._constructor_.md
+++ /dev/null
@@ -1,20 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [OptionedParamType](./kibana-plugin-plugins-data-server.optionedparamtype.md) &gt; [(constructor)](./kibana-plugin-plugins-data-server.optionedparamtype._constructor_.md)
-
-## OptionedParamType.(constructor)
-
-Constructs a new instance of the `OptionedParamType` class
-
-<b>Signature:</b>
-
-```typescript
-constructor(config: Record<string, any>);
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  config | <code>Record&lt;string, any&gt;</code> |  |
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedparamtype.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedparamtype.md
deleted file mode 100644
index 6bf2ef4baa9154..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedparamtype.md
+++ /dev/null
@@ -1,24 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [OptionedParamType](./kibana-plugin-plugins-data-server.optionedparamtype.md)
-
-## OptionedParamType class
-
-<b>Signature:</b>
-
-```typescript
-export declare class OptionedParamType extends BaseParamType 
-```
-
-## Constructors
-
-|  Constructor | Modifiers | Description |
-|  --- | --- | --- |
-|  [(constructor)(config)](./kibana-plugin-plugins-data-server.optionedparamtype._constructor_.md) |  | Constructs a new instance of the <code>OptionedParamType</code> class |
-
-## Properties
-
-|  Property | Modifiers | Type | Description |
-|  --- | --- | --- | --- |
-|  [options](./kibana-plugin-plugins-data-server.optionedparamtype.options.md) |  | <code>OptionedValueProp[]</code> |  |
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedparamtype.options.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedparamtype.options.md
deleted file mode 100644
index 868619ad5a9e06..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedparamtype.options.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [OptionedParamType](./kibana-plugin-plugins-data-server.optionedparamtype.md) &gt; [options](./kibana-plugin-plugins-data-server.optionedparamtype.options.md)
-
-## OptionedParamType.options property
-
-<b>Signature:</b>
-
-```typescript
-options: OptionedValueProp[];
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedvalueprop.disabled.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedvalueprop.disabled.md
deleted file mode 100644
index e0a21a87276148..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedvalueprop.disabled.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [OptionedValueProp](./kibana-plugin-plugins-data-server.optionedvalueprop.md) &gt; [disabled](./kibana-plugin-plugins-data-server.optionedvalueprop.disabled.md)
-
-## OptionedValueProp.disabled property
-
-<b>Signature:</b>
-
-```typescript
-disabled?: boolean;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedvalueprop.iscompatible.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedvalueprop.iscompatible.md
deleted file mode 100644
index de3ecc0b97a64a..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedvalueprop.iscompatible.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [OptionedValueProp](./kibana-plugin-plugins-data-server.optionedvalueprop.md) &gt; [isCompatible](./kibana-plugin-plugins-data-server.optionedvalueprop.iscompatible.md)
-
-## OptionedValueProp.isCompatible property
-
-<b>Signature:</b>
-
-```typescript
-isCompatible: (agg: IAggConfig) => boolean;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedvalueprop.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedvalueprop.md
deleted file mode 100644
index ef2440035c83b6..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedvalueprop.md
+++ /dev/null
@@ -1,21 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [OptionedValueProp](./kibana-plugin-plugins-data-server.optionedvalueprop.md)
-
-## OptionedValueProp interface
-
-<b>Signature:</b>
-
-```typescript
-export interface OptionedValueProp 
-```
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [disabled](./kibana-plugin-plugins-data-server.optionedvalueprop.disabled.md) | <code>boolean</code> |  |
-|  [isCompatible](./kibana-plugin-plugins-data-server.optionedvalueprop.iscompatible.md) | <code>(agg: IAggConfig) =&gt; boolean</code> |  |
-|  [text](./kibana-plugin-plugins-data-server.optionedvalueprop.text.md) | <code>string</code> |  |
-|  [value](./kibana-plugin-plugins-data-server.optionedvalueprop.value.md) | <code>string</code> |  |
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedvalueprop.text.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedvalueprop.text.md
deleted file mode 100644
index 0a2b3ac708038b..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedvalueprop.text.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [OptionedValueProp](./kibana-plugin-plugins-data-server.optionedvalueprop.md) &gt; [text](./kibana-plugin-plugins-data-server.optionedvalueprop.text.md)
-
-## OptionedValueProp.text property
-
-<b>Signature:</b>
-
-```typescript
-text: string;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedvalueprop.value.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedvalueprop.value.md
deleted file mode 100644
index 76618558d0479a..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.optionedvalueprop.value.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [OptionedValueProp](./kibana-plugin-plugins-data-server.optionedvalueprop.md) &gt; [value](./kibana-plugin-plugins-data-server.optionedvalueprop.value.md)
-
-## OptionedValueProp.value property
-
-<b>Signature:</b>
-
-```typescript
-value: string;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.plugin.setup.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.plugin.setup.md
index bd90f23b4ab590..5763cb2dacb7ac 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.plugin.setup.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.plugin.setup.md
@@ -7,12 +7,10 @@
 <b>Signature:</b>
 
 ```typescript
-setup(core: CoreSetup<DataPluginStartDependencies, DataPluginStart>, { bfetch, expressions, usageCollection }: DataPluginSetupDependencies): {
+setup(core: CoreSetup<DataPluginStartDependencies, DataPluginStart>, { bfetch, expressions, usageCollection, fieldFormats }: DataPluginSetupDependencies): {
         __enhance: (enhancements: DataEnhancements) => void;
         search: ISearchSetup;
-        fieldFormats: {
-            register: (customFieldFormat: import("../public").FieldFormatInstanceType) => number;
-        };
+        fieldFormats: FieldFormatsSetup;
     };
 ```
 
@@ -21,15 +19,13 @@ setup(core: CoreSetup<DataPluginStartDependencies, DataPluginStart>, { bfetch, e
 |  Parameter | Type | Description |
 |  --- | --- | --- |
 |  core | <code>CoreSetup&lt;DataPluginStartDependencies, DataPluginStart&gt;</code> |  |
-|  { bfetch, expressions, usageCollection } | <code>DataPluginSetupDependencies</code> |  |
+|  { bfetch, expressions, usageCollection, fieldFormats } | <code>DataPluginSetupDependencies</code> |  |
 
 <b>Returns:</b>
 
 `{
         __enhance: (enhancements: DataEnhancements) => void;
         search: ISearchSetup;
-        fieldFormats: {
-            register: (customFieldFormat: import("../public").FieldFormatInstanceType) => number;
-        };
+        fieldFormats: FieldFormatsSetup;
     }`
 
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.plugin.start.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.plugin.start.md
index dd1f3806c14081..a31e4512cfcf1b 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.plugin.start.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.plugin.start.md
@@ -7,10 +7,8 @@
 <b>Signature:</b>
 
 ```typescript
-start(core: CoreStart): {
-        fieldFormats: {
-            fieldFormatServiceFactory: (uiSettings: import("../../../core/server").IUiSettingsClient) => Promise<import("../common").FieldFormatsRegistry>;
-        };
+start(core: CoreStart, { fieldFormats }: DataPluginStartDependencies): {
+        fieldFormats: FieldFormatsStart;
         indexPatterns: {
             indexPatternsServiceFactory: (savedObjectsClient: Pick<import("../../../core/server").SavedObjectsClient, "update" | "get" | "delete" | "create" | "bulkCreate" | "checkConflicts" | "find" | "bulkGet" | "resolve" | "collectMultiNamespaceReferences" | "updateObjectsSpaces" | "bulkUpdate" | "removeReferencesTo" | "openPointInTimeForType" | "closePointInTime" | "createPointInTimeFinder" | "errors">, elasticsearchClient: import("../../../core/server").ElasticsearchClient) => Promise<import(".").IndexPatternsService>;
         };
@@ -23,13 +21,12 @@ start(core: CoreStart): {
 |  Parameter | Type | Description |
 |  --- | --- | --- |
 |  core | <code>CoreStart</code> |  |
+|  { fieldFormats } | <code>DataPluginStartDependencies</code> |  |
 
 <b>Returns:</b>
 
 `{
-        fieldFormats: {
-            fieldFormatServiceFactory: (uiSettings: import("../../../core/server").IUiSettingsClient) => Promise<import("../common").FieldFormatsRegistry>;
-        };
+        fieldFormats: FieldFormatsStart;
         indexPatterns: {
             indexPatternsServiceFactory: (savedObjectsClient: Pick<import("../../../core/server").SavedObjectsClient, "update" | "get" | "delete" | "create" | "bulkCreate" | "checkConflicts" | "find" | "bulkGet" | "resolve" | "collectMultiNamespaceReferences" | "updateObjectsSpaces" | "bulkUpdate" | "removeReferencesTo" | "openPointInTimeForType" | "closePointInTime" | "createPointInTimeFinder" | "errors">, elasticsearchClient: import("../../../core/server").ElasticsearchClient) => Promise<import(".").IndexPatternsService>;
         };
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.pluginsetup.fieldformats.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.pluginsetup.fieldformats.md
index 648e23e597f4d1..55badaf2d07bc6 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.pluginsetup.fieldformats.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.pluginsetup.fieldformats.md
@@ -4,6 +4,11 @@
 
 ## PluginSetup.fieldFormats property
 
+> Warning: This API is now obsolete.
+> 
+> - use "fieldFormats" plugin directly instead
+> 
+
 <b>Signature:</b>
 
 ```typescript
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.pluginstart.fieldformats.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.pluginstart.fieldformats.md
index 7a77c6c943cd7e..26182e96a4a7e9 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.pluginstart.fieldformats.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.pluginstart.fieldformats.md
@@ -4,6 +4,11 @@
 
 ## PluginStart.fieldFormats property
 
+> Warning: This API is now obsolete.
+> 
+> - use "fieldFormats" plugin directly instead
+> 
+
 <b>Signature:</b>
 
 ```typescript
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.refreshinterval.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.refreshinterval.md
deleted file mode 100644
index ebb983de299425..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.refreshinterval.md
+++ /dev/null
@@ -1,19 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [RefreshInterval](./kibana-plugin-plugins-data-server.refreshinterval.md)
-
-## RefreshInterval interface
-
-<b>Signature:</b>
-
-```typescript
-export interface RefreshInterval 
-```
-
-## Properties
-
-|  Property | Type | Description |
-|  --- | --- | --- |
-|  [pause](./kibana-plugin-plugins-data-server.refreshinterval.pause.md) | <code>boolean</code> |  |
-|  [value](./kibana-plugin-plugins-data-server.refreshinterval.value.md) | <code>number</code> |  |
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.refreshinterval.pause.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.refreshinterval.pause.md
deleted file mode 100644
index d045a3c0b9a218..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.refreshinterval.pause.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [RefreshInterval](./kibana-plugin-plugins-data-server.refreshinterval.md) &gt; [pause](./kibana-plugin-plugins-data-server.refreshinterval.pause.md)
-
-## RefreshInterval.pause property
-
-<b>Signature:</b>
-
-```typescript
-pause: boolean;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.refreshinterval.value.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.refreshinterval.value.md
deleted file mode 100644
index 8b48d97a649c0c..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.refreshinterval.value.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [RefreshInterval](./kibana-plugin-plugins-data-server.refreshinterval.md) &gt; [value](./kibana-plugin-plugins-data-server.refreshinterval.value.md)
-
-## RefreshInterval.value property
-
-<b>Signature:</b>
-
-```typescript
-value: number;
-```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.search.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.search.md
index 7072f25489db29..79ff117a330500 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.search.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.search.md
@@ -11,32 +11,9 @@ search: {
     aggs: {
         CidrMask: typeof CidrMask;
         dateHistogramInterval: typeof dateHistogramInterval;
-        intervalOptions: ({
-            display: string;
-            val: string;
-            enabled(agg: import("../common").IBucketAggConfig): boolean;
-        } | {
-            display: string;
-            val: string;
-        })[];
-        InvalidEsCalendarIntervalError: typeof InvalidEsCalendarIntervalError;
-        InvalidEsIntervalFormatError: typeof InvalidEsIntervalFormatError;
         IpAddress: typeof IpAddress;
-        isNumberType: (agg: import("../common").AggConfig) => boolean;
-        isStringType: (agg: import("../common").AggConfig) => boolean;
-        isType: (...types: string[]) => (agg: import("../common").AggConfig) => boolean;
-        isValidEsInterval: typeof isValidEsInterval;
-        isValidInterval: typeof isValidInterval;
-        parentPipelineType: string;
-        parseEsInterval: typeof parseEsInterval;
         parseInterval: typeof parseInterval;
-        propFilter: typeof propFilter;
-        siblingPipelineType: string;
-        termsAggFilter: string[];
-        toAbsoluteDates: typeof toAbsoluteDates;
         calcAutoIntervalLessThan: typeof calcAutoIntervalLessThan;
     };
-    tabifyAggResponse: typeof tabifyAggResponse;
-    tabifyGetColumns: typeof tabifyGetColumns;
 }
 ```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.searchusage.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.searchusage.md
deleted file mode 100644
index d867509e915b6a..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.searchusage.md
+++ /dev/null
@@ -1,19 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [SearchUsage](./kibana-plugin-plugins-data-server.searchusage.md)
-
-## SearchUsage interface
-
-<b>Signature:</b>
-
-```typescript
-export interface SearchUsage 
-```
-
-## Methods
-
-|  Method | Description |
-|  --- | --- |
-|  [trackError()](./kibana-plugin-plugins-data-server.searchusage.trackerror.md) |  |
-|  [trackSuccess(duration)](./kibana-plugin-plugins-data-server.searchusage.tracksuccess.md) |  |
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.searchusage.trackerror.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.searchusage.trackerror.md
deleted file mode 100644
index 212133588f62d5..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.searchusage.trackerror.md
+++ /dev/null
@@ -1,15 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [SearchUsage](./kibana-plugin-plugins-data-server.searchusage.md) &gt; [trackError](./kibana-plugin-plugins-data-server.searchusage.trackerror.md)
-
-## SearchUsage.trackError() method
-
-<b>Signature:</b>
-
-```typescript
-trackError(): Promise<void>;
-```
-<b>Returns:</b>
-
-`Promise<void>`
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.searchusage.tracksuccess.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.searchusage.tracksuccess.md
deleted file mode 100644
index b58f440c7dccf6..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.searchusage.tracksuccess.md
+++ /dev/null
@@ -1,22 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [SearchUsage](./kibana-plugin-plugins-data-server.searchusage.md) &gt; [trackSuccess](./kibana-plugin-plugins-data-server.searchusage.tracksuccess.md)
-
-## SearchUsage.trackSuccess() method
-
-<b>Signature:</b>
-
-```typescript
-trackSuccess(duration: number): Promise<void>;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  duration | <code>number</code> |  |
-
-<b>Returns:</b>
-
-`Promise<void>`
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.searchusageobserver.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.searchusageobserver.md
deleted file mode 100644
index e9c7b33766e56c..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.searchusageobserver.md
+++ /dev/null
@@ -1,32 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [searchUsageObserver](./kibana-plugin-plugins-data-server.searchusageobserver.md)
-
-## searchUsageObserver() function
-
-Rxjs observer for easily doing `tap(searchUsageObserver(logger, usage))` in an rxjs chain.
-
-<b>Signature:</b>
-
-```typescript
-export declare function searchUsageObserver(logger: Logger, usage?: SearchUsage, { isRestore }?: ISearchOptions): {
-    next(response: IEsSearchResponse): void;
-    error(): void;
-};
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  logger | <code>Logger</code> |  |
-|  usage | <code>SearchUsage</code> |  |
-|  { isRestore } | <code>ISearchOptions</code> |  |
-
-<b>Returns:</b>
-
-`{
-    next(response: IEsSearchResponse): void;
-    error(): void;
-}`
-
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ui_settings.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ui_settings.md
index 387dac22e1c83b..e1f002674ef6db 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ui_settings.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.ui_settings.md
@@ -24,13 +24,6 @@ UI_SETTINGS: {
     readonly HISTOGRAM_BAR_TARGET: "histogram:barTarget";
     readonly HISTOGRAM_MAX_BARS: "histogram:maxBars";
     readonly HISTORY_LIMIT: "history:limit";
-    readonly SHORT_DOTS_ENABLE: "shortDots:enable";
-    readonly FORMAT_DEFAULT_TYPE_MAP: "format:defaultTypeMap";
-    readonly FORMAT_NUMBER_DEFAULT_PATTERN: "format:number:defaultPattern";
-    readonly FORMAT_PERCENT_DEFAULT_PATTERN: "format:percent:defaultPattern";
-    readonly FORMAT_BYTES_DEFAULT_PATTERN: "format:bytes:defaultPattern";
-    readonly FORMAT_CURRENCY_DEFAULT_PATTERN: "format:currency:defaultPattern";
-    readonly FORMAT_NUMBER_DEFAULT_LOCALE: "format:number:defaultLocale";
     readonly TIMEPICKER_REFRESH_INTERVAL_DEFAULTS: "timepicker:refreshIntervalDefaults";
     readonly TIMEPICKER_QUICK_RANGES: "timepicker:quickRanges";
     readonly TIMEPICKER_TIME_DEFAULTS: "timepicker:timeDefaults";
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.usageprovider.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.usageprovider.md
deleted file mode 100644
index ad5c61b5c85a1c..00000000000000
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.usageprovider.md
+++ /dev/null
@@ -1,22 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [usageProvider](./kibana-plugin-plugins-data-server.usageprovider.md)
-
-## usageProvider() function
-
-<b>Signature:</b>
-
-```typescript
-export declare function usageProvider(core: CoreSetup): SearchUsage;
-```
-
-## Parameters
-
-|  Parameter | Type | Description |
-|  --- | --- | --- |
-|  core | <code>CoreSetup</code> |  |
-
-<b>Returns:</b>
-
-`SearchUsage`
-
diff --git a/docs/maps/asset-tracking-tutorial.asciidoc b/docs/maps/asset-tracking-tutorial.asciidoc
new file mode 100644
index 00000000000000..822510e882c128
--- /dev/null
+++ b/docs/maps/asset-tracking-tutorial.asciidoc
@@ -0,0 +1,340 @@
+[role="xpack"]
+[[asset-tracking-tutorial]]
+== Track, visualize, and alert on assets in real time
+
+Are you interested in asset tracking? Good news! Visualizing and analyzing data that moves is easy with *Maps*. You can track the location of an IoT device and monitor a package or vehicle in transit.
+
+In this tutorial, you’ll look at live urban transit data from the city of Portland, Oregon. You’ll watch the city buses, use the data to visualize congestion, and notify a dispatch team when a bus enters a construction zone.
+
+You’ll learn to:
+
+- Use Logstash to ingest the TriMet REST API into Elasticsearch.
+- Create a map with layers that visualize asset tracks and last-known locations.
+- Use symbols and colors to style data values and show which direction an asset is heading.
+- Set up tracking containment alerts to monitor moving vehicles.
+
+When you complete this tutorial, you’ll have a map that looks like this:
+
+[role="screenshot"]
+image::maps/images/asset-tracking-tutorial/construction_zones.png[]
+
+[float]
+=== Prerequisites
+
+- If you don’t already have {kib}, set it up with https://www.elastic.co/cloud/elasticsearch-service/signup?baymax=docs-body&elektra=docs[our free trial]. Download the deployment credentials.
+- Obtain an API key for https://developer.trimet.org/[TriMet web services] at https://developer.trimet.org/appid/registration/.
+- https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html[Install Logstash].
+
+[float]
+=== Part 1: Ingest the Portland bus data
+To get to the fun of visualizing and alerting on Portland buses, you must first create a Logstash pipeline to ingest the TriMet Portland bus data into {es}.
+
+[float]
+==== Step 1: Set up an Elasticsearch index
+
+. In Kibana, open the main menu, then click *Dev Tools*.
+. In *Console*, create the `tri_met_tracks` index:
++
+[source,js]
+----------------------------------
+PUT tri_met_tracks
+----------------------------------
+
+. To configure the `tri_met_tracks` index mappings, run:
++
+[source,js]
+----------------------------------
+PUT tri_met_tracks/_mapping
+{
+  "properties": {
+    "in_congestion": {
+      "type": "boolean"
+    },
+    "location": {
+      "type": "geo_point"
+    },
+    "route": {
+      "type": "keyword"
+    },
+    "time": {
+      "type": "date",
+      "format": "epoch_millis"
+    },
+    "type": {
+      "type": "keyword"
+    },
+    "vehicle_id": {
+      "type": "keyword"
+    }
+  }
+}
+----------------------------------
+
+[float]
+==== Step 2: Start Logstash
+
+. In your `logstash/config` folder, create the file `trimet-pipeline.conf`.
+. Copy the pipeline script into your `trimet-pipeline.conf` file.
++
+[source,yaml]
+----------------------------------
+input {
+  http_poller {
+    urls => {
+      trimet => "https://developer.trimet.org/ws/v2/vehicles?appID=<tri_met_app_id>"
+    }
+    request_timeout => 60
+    schedule => { cron => "* * * * * UTC"}
+    codec => "json"
+  }
+}
+
+filter {
+  split {
+    field => "[resultSet][vehicle]"
+  }
+
+  if ![resultSet][vehicle][inCongestion] {
+    mutate {
+      update => {
+        "[resultSet][vehicle][inCongestion]" => "false"
+      }
+    }
+  }
+
+  mutate {
+    add_field => {
+      "bearing" => "%{[resultSet][vehicle][bearing]}"
+      "in_congestion" => "%{[resultSet][vehicle][inCongestion]}"
+      "location" => "%{[resultSet][vehicle][latitude]},%{[resultSet][vehicle][longitude]}"
+      "route" => "%{[resultSet][vehicle][routeNumber]}"
+      "time" => "%{[resultSet][vehicle][time]}"
+      "type" => "%{[resultSet][vehicle][type]}"
+      "vehicle_id" => "%{[resultSet][vehicle][vehicleID]}"
+    }
+    remove_field => [ "resultSet", "@version", "@timestamp" ]
+  }
+
+  mutate {
+    convert => {
+      "bearing" => "float"
+  "in_congestion" => "boolean"
+      "time" => "integer"
+    }
+  }
+}
+
+output {
+  stdout {
+    codec => rubydebug
+  }
+
+  elasticsearch {
+    cloud_auth => "<username:password>"
+    cloud_id => "<cloud_id>"
+    index => "tri_met_tracks"
+    document_id => "%{[vehicle_id]}_%{[time]}"
+  }
+}
+----------------------------------
+
+. Replace `<tri_met_app_id>` with your TriMet application id.
+. Replace `<username:password>` with your Elastic Cloud deployment credentials.
+. Replace `<cloud_id>` with your {ece}/ece-cloud-id.html[elastic cloud id].
+. Open a terminal window, and then navigate to the Logstash folder.
+. In your `logstash` folder, run Logstash with the TriMet pipeline:
++
+[source,bash]
+----------------------------------
+bin/logstash -f config/trimet-pipeline.conf
+----------------------------------
+
+. Wait for Logstash to initialize and confirm data is flowing. You should see messages similar to this:
++
+[role="screenshot"]
+image::maps/images/asset-tracking-tutorial/logstash_output.png[]
+. Leave the terminal window open and Logstash running throughout this tutorial.
+
+[float]
+==== Step 3: Create a {kib} index pattern for the tri_met_tracks {es} index
+
+. In Kibana, open the main menu, and click *Stack Management > Index Patterns*.
+. Click *Create index pattern*.
+. Give the index pattern a name: *tri_met_tracks**.
+. Click *Next step*.
+. Set the *Time field* to *time*.
+. Click *Create index pattern*.
+
+{kib} shows the fields in your index pattern.
+
+[role="screenshot"]
+image::maps/images/asset-tracking-tutorial/index_pattern.png[]
+
+[float]
+==== Step 4: Explore the Portland bus data
+
+. Open the main menu, and click *Discover*.
+. Set the index pattern to *tri_met_tracks**.
+. Open the <<set-time-filter, time filter>>, and set the time range to the last 15 minutes.
+. Expand a document and explore some of the fields that you will use later in this tutorial: `bearing`, `in_congestion`, `location`, and `vehicle_id`.
+
+[role="screenshot"]
+image::maps/images/asset-tracking-tutorial/discover.png[]
+
+[float]
+=== Part 2: Build an operational map
+It's hard to get an overview of Portland buses by looking at individual events. Let's create a map to show the bus routes and current location for each bus, along with the direction the buses are headed.
+
+[float]
+==== Step 1: Create your map
+Create your map and set the theme for the default layer to dark mode.
+
+. Open the main menu, and click *Maps*.
+. Click *Create map*.
+. In the *Layers* list, click *Road map*, and then click *Edit layer settings*.
+. Open the *Tile service* dropdown, and select *Road map - dark*.
+. Click *Save & close*.
+
+[float]
+==== Step 2. Add a tracks layer
+
+Add a layer to show the bus routes for the last 15 minutes.
+
+. Click *Add layer*.
+. Click *Tracks*.
+. Select the *tri_met_tracks** index pattern.
+. Define the tracks:
+.. Set *Entity* to *vehicle_id*.
+.. Set *Sort* to *time*.
+. Click *Add layer*.
+. In Layer settings:
+.. Set *Name* to *Buses*.
+.. Set *Opacity* to 80%.
+. Scroll to *Layer Style*, and set *Border color* to pink.
+. Click *Save & close*.
+. In the *Layers* list, click *Buses*, and then click *Fit to data*.
+
+At this point, you have a map with lines that represent the routes of the buses as they move around the city.
+
+[role="screenshot"]
+image::maps/images/asset-tracking-tutorial/tracks_layer.png[]
+
+[float]
+==== Step 3. Indicate the direction of the bus tracks
+
+Add a layer that uses attributes in the data to set the style and orientation of the buses. You’ll see the direction buses are headed and what traffic is like.
+
+. Click *Add layer*, and then select *Top Hits per entity*.
+. Select the *tri_met_tracks** index pattern.
+. To display the most recent location per bus:
+.. Set *Entity* to *vehicle_id*.
+.. Set *Documents per entity* to 1.
+.. Set *Sort field* to *time*.
+.. Set *Sort order* to *descending*.
+. Click *Add layer*.
+. Scroll to *Layer Style*.
+.. Set *Symbol type* to *icon*.
+.. Set *Icon* to *arrow-es*.
+.. Set the *Fill color*:
+... Select *By value* styling, and set the field to *in_congestion*.
+... Use a *Custom color palette*.
+... Set the *Other* color to black.
+... Add a green class for *false*, meaning the bus is not in traffic.
+... Add a red class for *true*, meaning the bus is in congestion.
+.. Set *Border width* to 0.
+.. Change *Symbol orientation* to use *By value* and the *bearing* field.
++
+[role="screenshot"]
+image::maps/images/asset-tracking-tutorial/top_hits_layer_style.png[]
+. Click *Save & close*.
+. Open the <<set-time-filter, time filter>>, and set *Refresh every* to 10 seconds, and click *Start*.
+
+Your map should automatically refresh every 10 seconds to show the lastest bus positions and tracks.
+
+[role="screenshot"]
+image::maps/images/asset-tracking-tutorial/tracks_and_top_hits.png[]
+
+[float]
+=== Part 3: Setup geo-fencing alerts
+Let's make TriMet Portland bus data actionable and alert when buses enter construction zones.
+
+[float]
+==== Step 1. Add a construction zone
+
+Add a layer for construction zones, which you will draw on the map. The construction zones will be used as your geofence boundary or threshold that serves as the basis for triggering alerts.
+
+. Click *Add layer*.
+. Click *Create index*.
+. Set *Index name* to *construction_zones*.
+. Click *Create index*.
+. Draw 2 or 3 construction zones on your map:
+.. In the toolbar on left side of the map, select the bounding box icon image:maps/images/asset-tracking-tutorial/bounding_box_icon.png[bounding box icon].
+.. To draw a construction zone, click a start point on the map and drag.
+.. Click an endpoint to finish.
+. When you finish drawing the construction zones, click *Exit* under the layer name in the legend.
+. In *Layer settings*, set *Name* to *Construction zones*.
+. Scroll to *Layer Style*, and set *Fill color* to yellow.
+. Click *Save & close*.
+. *Save* the map.
+.. Give the map a title.
+.. Under *Add to dashboard*, select *None*.
+.. Click *Save and add to library*.
+
+The map now represents an operational view of live bus traffic.  You’ll see the direction that the buses are traveling, and whether they are near or have entered a construction zone.
+
+Your map is now complete.
+
+[role="screenshot"]
+image::maps/images/asset-tracking-tutorial/construction_zones.png[]
+
+
+[float]
+==== Step 2. Configure an alert
+
+Create a new alert by defining a rule and a connector. The rule includes the conditions that will trigger the alert, and the connector defines what action takes place once the alert is triggered. In this case, each alert will log a message to the Kibana log.
+
+. Open *Stack Management*, and then click *Rules and Connectors*.
+. Click *Create rule*.
+. Name the rule *Bus Alerts*.
+. Set *Check every* to *5 seconds*.
+. Notify *Only on status change*.
++
+[role="screenshot"]
+image::maps/images/asset-tracking-tutorial/rule_configuration.png[]
+. Select the *Tracking containment* rule type.
+. Set *Select entity*:
+.. Set *INDEX* to *tri_met_tracks**.
+.. Set *BY* to *vehicle_id*.
+. Set *Select boundary* *INDEX* to *construction_zones*.
++
+[role="screenshot"]
+image::maps/images/asset-tracking-tutorial/tracking_containment_configuration.png[]
+. Under *Actions*, select the *Server log* connector type.
+. Click *Create a connector*.
+. In the *Server log connector*:
+.. Set *Connector name* to *Bus alert connector*.
+.. Click *Save*.
+. Complete the *Actions* configuration.
+.. Set *Message* to :
++
+[source,js]
+----------------------------------
+{
+  "entityId": "{{context.entityId}}",
+  "entityDateTime": "{{context.entityDateTime}}",
+  "entityDocumentId": "{{context.entityDocumentId}}",
+  "detectionDateTime": "{{context.detectionDateTime}}",
+  "entityLocation": "{{context.entityLocation}}",
+  "containingBoundaryId": "{{context.containingBoundaryId}}",
+  "containingBoundaryName": "{{context.containingBoundaryName}}"
+}
+----------------------------------
+
+. Click *Save*.
+
+The *Bus Alert connector* is added to the *Rules and Connectors* page. For more information on common connectors, refer to the <<slack-action-type, Slack>> and <<email-action-type, Email>> connectors.
+
+[role="screenshot"]
+image::maps/images/asset-tracking-tutorial/rules_and_connectors.png[]
+
+Congratulations! You have completed the tutorial and have the recipe for tracking assets. You can now try replicating this same analysis with your own data.
diff --git a/docs/maps/images/asset-tracking-tutorial/bounding_box_icon.png b/docs/maps/images/asset-tracking-tutorial/bounding_box_icon.png
new file mode 100644
index 00000000000000..a7289c35fc0c33
Binary files /dev/null and b/docs/maps/images/asset-tracking-tutorial/bounding_box_icon.png differ
diff --git a/docs/maps/images/asset-tracking-tutorial/construction_zones.png b/docs/maps/images/asset-tracking-tutorial/construction_zones.png
new file mode 100644
index 00000000000000..0487c3d040a3b2
Binary files /dev/null and b/docs/maps/images/asset-tracking-tutorial/construction_zones.png differ
diff --git a/docs/maps/images/asset-tracking-tutorial/discover.png b/docs/maps/images/asset-tracking-tutorial/discover.png
new file mode 100644
index 00000000000000..d5ea0e55eeddef
Binary files /dev/null and b/docs/maps/images/asset-tracking-tutorial/discover.png differ
diff --git a/docs/maps/images/asset-tracking-tutorial/index_pattern.png b/docs/maps/images/asset-tracking-tutorial/index_pattern.png
new file mode 100644
index 00000000000000..e1aaecbe62d657
Binary files /dev/null and b/docs/maps/images/asset-tracking-tutorial/index_pattern.png differ
diff --git a/docs/maps/images/asset-tracking-tutorial/logstash_output.png b/docs/maps/images/asset-tracking-tutorial/logstash_output.png
new file mode 100644
index 00000000000000..9235e31e985049
Binary files /dev/null and b/docs/maps/images/asset-tracking-tutorial/logstash_output.png differ
diff --git a/docs/maps/images/asset-tracking-tutorial/rule_configuration.png b/docs/maps/images/asset-tracking-tutorial/rule_configuration.png
new file mode 100644
index 00000000000000..a94c5a9e1dba9d
Binary files /dev/null and b/docs/maps/images/asset-tracking-tutorial/rule_configuration.png differ
diff --git a/docs/maps/images/asset-tracking-tutorial/rules_and_connectors.png b/docs/maps/images/asset-tracking-tutorial/rules_and_connectors.png
new file mode 100644
index 00000000000000..35d89dd42ab277
Binary files /dev/null and b/docs/maps/images/asset-tracking-tutorial/rules_and_connectors.png differ
diff --git a/docs/maps/images/asset-tracking-tutorial/top_hits_layer_style.png b/docs/maps/images/asset-tracking-tutorial/top_hits_layer_style.png
new file mode 100644
index 00000000000000..b4a869529ad45b
Binary files /dev/null and b/docs/maps/images/asset-tracking-tutorial/top_hits_layer_style.png differ
diff --git a/docs/maps/images/asset-tracking-tutorial/tracking_containment_configuration.png b/docs/maps/images/asset-tracking-tutorial/tracking_containment_configuration.png
new file mode 100644
index 00000000000000..4baf34bb414f16
Binary files /dev/null and b/docs/maps/images/asset-tracking-tutorial/tracking_containment_configuration.png differ
diff --git a/docs/maps/images/asset-tracking-tutorial/tracks_and_top_hits.png b/docs/maps/images/asset-tracking-tutorial/tracks_and_top_hits.png
new file mode 100644
index 00000000000000..3dd856af4a18ec
Binary files /dev/null and b/docs/maps/images/asset-tracking-tutorial/tracks_and_top_hits.png differ
diff --git a/docs/maps/images/asset-tracking-tutorial/tracks_layer.png b/docs/maps/images/asset-tracking-tutorial/tracks_layer.png
new file mode 100644
index 00000000000000..b1275ec9d502f7
Binary files /dev/null and b/docs/maps/images/asset-tracking-tutorial/tracks_layer.png differ
diff --git a/docs/maps/index.asciidoc b/docs/maps/index.asciidoc
index 0922a4cc94c222..e2b379b7eb8c2c 100644
--- a/docs/maps/index.asciidoc
+++ b/docs/maps/index.asciidoc
@@ -74,6 +74,7 @@ Search across the layers in your map to focus in on just the data you want. Comb
 --
 
 include::maps-getting-started.asciidoc[]
+include::asset-tracking-tutorial.asciidoc[]
 include::heatmap-layer.asciidoc[]
 include::tile-layer.asciidoc[]
 include::vector-layer.asciidoc[]
diff --git a/docs/user/monitoring/kibana-alerts.asciidoc b/docs/user/monitoring/kibana-alerts.asciidoc
index beaae1fdb71b68..f00a3999ab2775 100644
--- a/docs/user/monitoring/kibana-alerts.asciidoc
+++ b/docs/user/monitoring/kibana-alerts.asciidoc
@@ -11,8 +11,7 @@ specific needs.
 [role="screenshot"]
 image::user/monitoring/images/monitoring-kibana-alerting-notification.png["{kib} alerting notifications in {stack-monitor-app}"]
 
-When you open *{stack-monitor-app}*, you will be ask to create these rules 
-They are initially configured to detect and notify on various 
+When you open *{stack-monitor-app}* for the first time, you will be asked to acknowledge the creation of these default rules. They are initially configured to detect and notify on various 
 conditions across your monitored clusters. You can view notifications for: *Cluster health*, *Resource utilization*, and *Errors and exceptions* for {es}
 in real time.
 
@@ -23,8 +22,8 @@ been recreated as rules in {kib} {alert-features}. For this reason, the existing
 The default action for all {stack-monitor-app} rules is to write to {kib} logs 
 and display a notification in the UI.
 
-To review and modify all available rules, click *Enter setup mode* on the 
-*Cluster overview* page.
+To review and modify existing *{stack-monitor-app}* rules, click *Enter setup mode* on the *Cluster overview* page.
+Alternatively, to manage all rules, including create and delete functionality go to *Stack Management > Rules and Connectors*.
 
 [discrete]
 [[kibana-alerts-cpu-threshold]]
diff --git a/package.json b/package.json
index b148eae39cbb35..2058eed5f024d5 100644
--- a/package.json
+++ b/package.json
@@ -95,11 +95,11 @@
   "dependencies": {
     "@elastic/apm-rum": "^5.8.0",
     "@elastic/apm-rum-react": "^1.2.11",
-    "@elastic/charts": "33.1.0",
+    "@elastic/charts": "33.2.0",
     "@elastic/datemath": "link:bazel-bin/packages/elastic-datemath",
-    "@elastic/elasticsearch": "npm:@elastic/elasticsearch-canary@^8.0.0-canary.13",
+    "@elastic/elasticsearch": "npm:@elastic/elasticsearch-canary@^8.0.0-canary.14",
     "@elastic/ems-client": "7.14.0",
-    "@elastic/eui": "36.0.0",
+    "@elastic/eui": "36.1.0",
     "@elastic/filesaver": "1.1.2",
     "@elastic/good": "^9.0.1-kibana3",
     "@elastic/maki": "6.3.0",
@@ -438,7 +438,6 @@
     "@babel/plugin-proposal-object-rest-spread": "^7.12.1",
     "@babel/plugin-proposal-optional-chaining": "^7.12.7",
     "@babel/plugin-proposal-private-methods": "^7.12.1",
-    "@babel/plugin-transform-modules-commonjs": "^7.12.1",
     "@babel/plugin-transform-runtime": "^7.12.10",
     "@babel/preset-env": "^7.12.11",
     "@babel/preset-react": "^7.12.10",
diff --git a/packages/kbn-es/src/utils/native_realm.js b/packages/kbn-es/src/utils/native_realm.js
index a5051cdb0d89a9..f7ee9da290dc6b 100644
--- a/packages/kbn-es/src/utils/native_realm.js
+++ b/packages/kbn-es/src/utils/native_realm.js
@@ -11,6 +11,23 @@ const chalk = require('chalk');
 
 const { log: defaultLog } = require('./log');
 
+/**
+ * Hack to skip the Product Check performed by the Elasticsearch-js client.
+ * We noticed a couple of bugs that may need to be fixed before taking full
+ * advantage of this feature.
+ *
+ * The bugs are detailed in this issue: https://github.com/elastic/kibana/issues/105557
+ *
+ * The hack is copied from the test/utils in the elasticsearch-js repo
+ * (https://github.com/elastic/elasticsearch-js/blob/master/test/utils/index.js#L45-L56)
+ */
+function skipProductCheck(client) {
+  const tSymbol = Object.getOwnPropertySymbols(client.transport || client).filter(
+    (symbol) => symbol.description === 'product check'
+  )[0];
+  (client.transport || client)[tSymbol] = 2;
+}
+
 exports.NativeRealm = class NativeRealm {
   constructor({ elasticPassword, port, log = defaultLog, ssl = false, caCert }) {
     this._client = new Client({
@@ -22,6 +39,8 @@ exports.NativeRealm = class NativeRealm {
           }
         : undefined,
     });
+    // TODO: @elastic/es-clients I had to disable the product check here because the client is getting 404 while ES is initializing, but the requests here auto retry them.
+    skipProductCheck(this._client);
     this._elasticPassword = elasticPassword;
     this._log = log;
   }
diff --git a/packages/kbn-optimizer/limits.yml b/packages/kbn-optimizer/limits.yml
index e814fe9db5e3a7..10ce4f7ab1d1f0 100644
--- a/packages/kbn-optimizer/limits.yml
+++ b/packages/kbn-optimizer/limits.yml
@@ -8,12 +8,12 @@ pageLoadAssetSize:
   charts: 95000
   cloud: 21076
   console: 46091
-  core: 432925
+  core: 434325
   crossClusterReplication: 65408
   dashboard: 374194
   dashboardEnhanced: 65646
   dashboardMode: 22716
-  data: 900000
+  data: 824229
   dataEnhanced: 50420
   devTools: 38637
   discover: 99999
@@ -24,6 +24,7 @@ pageLoadAssetSize:
   esUiShared: 326654
   expressions: 224136
   features: 21723
+  fieldFormats: 92628
   globalSearch: 29696
   globalSearchBar: 50403
   globalSearchProviders: 25554
@@ -33,6 +34,7 @@ pageLoadAssetSize:
   indexLifecycleManagement: 107090
   indexManagement: 140608
   indexPatternManagement: 28222
+  indexPatternEditor: 25000
   infra: 184320
   fleet: 465774
   ingestPipelines: 58003
@@ -118,4 +120,3 @@ pageLoadAssetSize:
   expressionMetric: 22238
   expressionShape: 34008
   interactiveSetup: 18532
-  
\ No newline at end of file
diff --git a/packages/kbn-rule-data-utils/src/alerts_as_data_rbac.ts b/packages/kbn-rule-data-utils/src/alerts_as_data_rbac.ts
index 2d0b0ec4a726c7..d3d20edffa2864 100644
--- a/packages/kbn-rule-data-utils/src/alerts_as_data_rbac.ts
+++ b/packages/kbn-rule-data-utils/src/alerts_as_data_rbac.ts
@@ -15,7 +15,7 @@
  * setting, with which the user can change the index prefix.
  */
 
-export const ALERTS_CONSUMERS = {
+export const AlertConsumers = {
   APM: 'apm',
   LOGS: 'logs',
   INFRASTRUCTURE: 'infrastructure',
@@ -23,9 +23,9 @@ export const ALERTS_CONSUMERS = {
   SIEM: 'siem',
   SYNTHETICS: 'synthetics',
 } as const;
-export type ALERTS_CONSUMERS = typeof ALERTS_CONSUMERS[keyof typeof ALERTS_CONSUMERS];
+export type AlertConsumers = typeof AlertConsumers[keyof typeof AlertConsumers];
 
-export const mapConsumerToIndexName: Record<ALERTS_CONSUMERS, string | string[]> = {
+export const mapConsumerToIndexName: Record<AlertConsumers, string | string[]> = {
   apm: '.alerts-observability-apm',
   logs: '.alerts-observability.logs',
   infrastructure: '.alerts-observability.metrics',
diff --git a/packages/kbn-rule-data-utils/src/technical_field_names.ts b/packages/kbn-rule-data-utils/src/technical_field_names.ts
index c55be6cfe8ff68..a29c1023caf673 100644
--- a/packages/kbn-rule-data-utils/src/technical_field_names.ts
+++ b/packages/kbn-rule-data-utils/src/technical_field_names.ts
@@ -34,6 +34,7 @@ const ALERT_EVALUATION_THRESHOLD = `${ALERT_NAMESPACE}.evaluation.threshold` as
 const ALERT_EVALUATION_VALUE = `${ALERT_NAMESPACE}.evaluation.value` as const;
 const ALERT_ID = `${ALERT_NAMESPACE}.id` as const;
 const ALERT_OWNER = `${ALERT_NAMESPACE}.owner` as const;
+const ALERT_CONSUMERS = `${ALERT_NAMESPACE}.consumers` as const;
 const ALERT_PRODUCER = `${ALERT_NAMESPACE}.producer` as const;
 const ALERT_REASON = `${ALERT_NAMESPACE}.reason` as const;
 const ALERT_RISK_SCORE = `${ALERT_NAMESPACE}.risk_score` as const;
@@ -70,10 +71,17 @@ const ALERT_RULE_SEVERITY_MAPPING = `${ALERT_RULE_NAMESPACE}.severity_mapping` a
 const ALERT_RULE_TAGS = `${ALERT_RULE_NAMESPACE}.tags` as const;
 const ALERT_RULE_TO = `${ALERT_RULE_NAMESPACE}.to` as const;
 const ALERT_RULE_TYPE = `${ALERT_RULE_NAMESPACE}.type` as const;
+const ALERT_RULE_TYPE_ID = `${ALERT_RULE_NAMESPACE}.rule_type_id` as const;
 const ALERT_RULE_UPDATED_AT = `${ALERT_RULE_NAMESPACE}.updated_at` as const;
 const ALERT_RULE_UPDATED_BY = `${ALERT_RULE_NAMESPACE}.updated_by` as const;
 const ALERT_RULE_VERSION = `${ALERT_RULE_NAMESPACE}.version` as const;
 
+const namespaces = {
+  KIBANA_NAMESPACE,
+  ALERT_NAMESPACE,
+  ALERT_RULE_NAMESPACE,
+};
+
 const fields = {
   CONSUMERS,
   ECS_VERSION,
@@ -93,6 +101,7 @@ const fields = {
   ALERT_EVALUATION_VALUE,
   ALERT_ID,
   ALERT_OWNER,
+  ALERT_CONSUMERS,
   ALERT_PRODUCER,
   ALERT_REASON,
   ALERT_RISK_SCORE,
@@ -118,6 +127,7 @@ const fields = {
   ALERT_RULE_TAGS,
   ALERT_RULE_TO,
   ALERT_RULE_TYPE,
+  ALERT_RULE_TYPE_ID,
   ALERT_RULE_UPDATED_AT,
   ALERT_RULE_UPDATED_BY,
   ALERT_RULE_VERSION,
@@ -142,7 +152,10 @@ export {
   ALERT_EVALUATION_THRESHOLD,
   ALERT_EVALUATION_VALUE,
   ALERT_ID,
+  ALERT_NAMESPACE,
+  ALERT_RULE_NAMESPACE,
   ALERT_OWNER,
+  ALERT_CONSUMERS,
   ALERT_PRODUCER,
   ALERT_REASON,
   ALERT_RISK_SCORE,
@@ -171,6 +184,7 @@ export {
   ALERT_RULE_TAGS,
   ALERT_RULE_TO,
   ALERT_RULE_TYPE,
+  ALERT_RULE_TYPE_ID,
   ALERT_RULE_UPDATED_AT,
   ALERT_RULE_UPDATED_BY,
   ALERT_RULE_VERSION,
@@ -185,6 +199,7 @@ export {
   ECS_VERSION,
   EVENT_ACTION,
   EVENT_KIND,
+  KIBANA_NAMESPACE,
   RULE_CATEGORY,
   RULE_CONSUMERS,
   RULE_ID,
@@ -196,4 +211,4 @@ export {
   VERSION,
 };
 
-export type TechnicalRuleDataFieldName = ValuesType<typeof fields>;
+export type TechnicalRuleDataFieldName = ValuesType<typeof fields & typeof namespaces>;
diff --git a/packages/kbn-server-route-repository/.babelrc b/packages/kbn-server-route-repository/.babelrc
new file mode 100644
index 00000000000000..7da72d17791281
--- /dev/null
+++ b/packages/kbn-server-route-repository/.babelrc
@@ -0,0 +1,3 @@
+{
+  "presets": ["@kbn/babel-preset/node_preset"]
+}
diff --git a/packages/kbn-server-route-repository/BUILD.bazel b/packages/kbn-server-route-repository/BUILD.bazel
index 3a146086e80bc3..147b72c65f9543 100644
--- a/packages/kbn-server-route-repository/BUILD.bazel
+++ b/packages/kbn-server-route-repository/BUILD.bazel
@@ -1,5 +1,6 @@
 load("@npm//@bazel/typescript:index.bzl", "ts_config", "ts_project")
 load("@build_bazel_rules_nodejs//:index.bzl", "js_library", "pkg_npm")
+load("//src/dev/bazel:index.bzl", "jsts_transpiler")
 
 PKG_BASE_NAME = "kbn-server-route-repository"
 PKG_REQUIRE_NAME = "@kbn/server-route-repository"
@@ -25,23 +26,31 @@ NPM_MODULE_EXTRA_FILES = [
   "README.md"
 ]
 
-SRC_DEPS = [
+RUNTIME_DEPS = [
   "//packages/kbn-config-schema",
   "//packages/kbn-io-ts-utils",
   "@npm//@hapi/boom",
   "@npm//fp-ts",
-  "@npm//io-ts",
   "@npm//lodash",
   "@npm//utility-types"
 ]
 
 TYPES_DEPS = [
+  "//packages/kbn-config-schema",
+  "//packages/kbn-io-ts-utils",
+  "@npm//@hapi/boom",
+  "@npm//fp-ts",
+  "@npm//utility-types",
   "@npm//@types/jest",
   "@npm//@types/lodash",
   "@npm//@types/node",
 ]
 
-DEPS = SRC_DEPS + TYPES_DEPS
+jsts_transpiler(
+  name = "target_node",
+  srcs = SRCS,
+  build_pkg_name = package_name(),
+)
 
 ts_config(
   name = "tsconfig",
@@ -52,14 +61,15 @@ ts_config(
 )
 
 ts_project(
-  name = "tsc",
+  name = "tsc_types",
   args = ['--pretty'],
   srcs = SRCS,
-  deps = DEPS,
+  deps = TYPES_DEPS,
   declaration = True,
   declaration_map = True,
-  incremental = True,
-  out_dir = "target",
+  emit_declaration_only = True,
+  incremental = False,
+  out_dir = "target_types",
   source_map = True,
   root_dir = "src",
   tsconfig = ":tsconfig",
@@ -68,7 +78,7 @@ ts_project(
 js_library(
   name = PKG_BASE_NAME,
   srcs = NPM_MODULE_EXTRA_FILES,
-  deps = DEPS + [":tsc"],
+  deps = RUNTIME_DEPS + [":target_node", ":tsc_types"],
   package_name = PKG_REQUIRE_NAME,
   visibility = ["//visibility:public"],
 )
diff --git a/packages/kbn-server-route-repository/package.json b/packages/kbn-server-route-repository/package.json
index cfeab275e19cf6..920abc2a3836f9 100644
--- a/packages/kbn-server-route-repository/package.json
+++ b/packages/kbn-server-route-repository/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@kbn/server-route-repository",
-  "main": "./target/index.js",
-  "types": "./target/index.d.ts",
+  "main": "./target_node/index.js",
+  "types": "./target_types/index.d.ts",
   "version": "1.0.0",
   "license": "SSPL-1.0 OR Elastic License 2.0",
   "private": true
diff --git a/packages/kbn-server-route-repository/tsconfig.json b/packages/kbn-server-route-repository/tsconfig.json
index 7614a9411602ef..947744bc68d425 100644
--- a/packages/kbn-server-route-repository/tsconfig.json
+++ b/packages/kbn-server-route-repository/tsconfig.json
@@ -1,13 +1,15 @@
 {
   "extends": "../../tsconfig.base.json",
   "compilerOptions": {
-    "incremental": true,
-    "outDir": "./target",
-    "stripInternal": false,
     "declaration": true,
     "declarationMap": true,
+    "emitDeclarationOnly": true,
+    "incremental": false,
+    "outDir": "./target_types",
+    "rootDir": "src",
     "sourceMap": true,
     "sourceRoot": "../../../../packages/kbn-server-route-repository/src",
+    "stripInternal": false,
     "types": [
       "jest",
       "node"
@@ -15,6 +17,6 @@
     "noUnusedLocals": false
   },
   "include": [
-    "./src/**/*.ts"
+    "src/**/*.ts"
   ]
 }
diff --git a/packages/kbn-telemetry-tools/.babelrc b/packages/kbn-telemetry-tools/.babelrc
new file mode 100644
index 00000000000000..7da72d17791281
--- /dev/null
+++ b/packages/kbn-telemetry-tools/.babelrc
@@ -0,0 +1,3 @@
+{
+  "presets": ["@kbn/babel-preset/node_preset"]
+}
diff --git a/packages/kbn-telemetry-tools/BUILD.bazel b/packages/kbn-telemetry-tools/BUILD.bazel
index cf71b3e197dad1..f90ca9b22dc922 100644
--- a/packages/kbn-telemetry-tools/BUILD.bazel
+++ b/packages/kbn-telemetry-tools/BUILD.bazel
@@ -1,5 +1,6 @@
 load("@npm//@bazel/typescript:index.bzl", "ts_config", "ts_project")
 load("@build_bazel_rules_nodejs//:index.bzl", "js_library", "pkg_npm")
+load("//src/dev/bazel:index.bzl", "jsts_transpiler")
 
 PKG_BASE_NAME = "kbn-telemetry-tools"
 PKG_REQUIRE_NAME = "@kbn/telemetry-tools"
@@ -28,29 +29,30 @@ NPM_MODULE_EXTRA_FILES = [
   "GUIDELINE.md",
 ]
 
-SRC_DEPS = [
+RUNTIME_DEPS = [
   "//packages/kbn-dev-utils",
   "//packages/kbn-utility-types",
   "@npm//glob",
   "@npm//listr",
   "@npm//normalize-path",
-  "@npm//tslib",
 ]
 
 TYPES_DEPS = [
-  "@npm//@types/flot",
+  "//packages/kbn-dev-utils",
+  "//packages/kbn-utility-types",
   "@npm//@types/glob",
   "@npm//@types/jest",
   "@npm//@types/listr",
   "@npm//@types/lodash",
   "@npm//@types/node",
   "@npm//@types/normalize-path",
-  "@npm//@types/testing-library__jest-dom",
-  "@npm//resize-observer-polyfill",
-  "@npm//@emotion/react",
 ]
 
-DEPS = SRC_DEPS + TYPES_DEPS
+jsts_transpiler(
+  name = "target_node",
+  srcs = SRCS,
+  build_pkg_name = package_name(),
+)
 
 ts_config(
   name = "tsconfig",
@@ -61,14 +63,15 @@ ts_config(
 )
 
 ts_project(
-  name = "tsc",
+  name = "tsc_types",
   args = ['--pretty'],
   srcs = SRCS,
-  deps = DEPS,
+  deps = TYPES_DEPS,
   declaration = True,
   declaration_map = True,
-  incremental = True,
-  out_dir = "target",
+  emit_declaration_only = True,
+  incremental = False,
+  out_dir = "target_types",
   source_map = True,
   root_dir = "src",
   tsconfig = ":tsconfig",
@@ -77,7 +80,7 @@ ts_project(
 js_library(
   name = PKG_BASE_NAME,
   srcs = NPM_MODULE_EXTRA_FILES,
-  deps = DEPS + [":tsc"],
+  deps = RUNTIME_DEPS + [":target_node", ":tsc_types"],
   package_name = PKG_REQUIRE_NAME,
   visibility = ["//visibility:public"],
 )
diff --git a/packages/kbn-telemetry-tools/package.json b/packages/kbn-telemetry-tools/package.json
index cd3fd3aa966c77..cb281524abefe5 100644
--- a/packages/kbn-telemetry-tools/package.json
+++ b/packages/kbn-telemetry-tools/package.json
@@ -2,8 +2,8 @@
   "name": "@kbn/telemetry-tools",
   "version": "1.0.0",
   "license": "SSPL-1.0 OR Elastic License 2.0",
-  "main": "./target/index.js",
-  "types": "./target/index.d.ts",
+  "main": "./target_node/index.js",
+  "types": "./target_types/index.d.ts",
   "private": true,
   "kibana": {
     "devOnly": true
diff --git a/packages/kbn-telemetry-tools/tsconfig.json b/packages/kbn-telemetry-tools/tsconfig.json
index 3c0e04ded359d4..1f1b4aea5d5c6b 100644
--- a/packages/kbn-telemetry-tools/tsconfig.json
+++ b/packages/kbn-telemetry-tools/tsconfig.json
@@ -1,14 +1,15 @@
 {
   "extends": "../../tsconfig.base.json",
   "compilerOptions": {
-    "incremental": true,
-    "outDir": "./target",
     "declaration": true,
     "declarationMap": true,
+    "emitDeclarationOnly": true,
+    "incremental": false,
+    "isolatedModules": true,
+    "outDir": "./target_types",
     "rootDir": "src",
     "sourceMap": true,
     "sourceRoot": "../../../../packages/kbn-telemetry-tools/src",
-    "isolatedModules": true,
     "types": [
       "jest",
       "node"
diff --git a/src/core/TESTING.md b/src/core/TESTING.md
index 5e0913e7a9d200..c95dfa46555705 100644
--- a/src/core/TESTING.md
+++ b/src/core/TESTING.md
@@ -1,1372 +1,3 @@
 # Testing Kibana Plugins
 
-This document outlines best practices and patterns for testing Kibana Plugins.
-
-- [Testing Kibana Plugins](#testing-kibana-plugins)
-  - [Strategy](#strategy)
-  - [New concerns in the Kibana Platform](#new-concerns-in-the-kibana-platform)
-  - [Core Integrations](#core-integrations)
-    - [Core Mocks](#core-mocks)
-      - [Example](#example)
-  - [Strategies for specific Core APIs](#strategies-for-specific-core-apis)
-    - [HTTP Routes](#http-routes)
-        - [Preconditions](#preconditions)
-      - [Unit testing](#unit-testing)
-          - [Example](#example-1)
-      - [Integration tests](#integration-tests)
-        - [Functional Test Runner](#functional-test-runner)
-          - [Example](#example-2)
-        - [TestUtils](#testutils)
-          - [Example](#example-3)
-    - [Applications](#applications)
-      - [Example](#example-4)
-    - [SavedObjects](#savedobjects)
-      - [Unit Tests](#unit-tests)
-      - [Integration Tests](#integration-tests-1)
-    - [Elasticsearch](#elasticsearch)
-  - [Plugin integrations](#plugin-integrations)
-    - [Preconditions](#preconditions-1)
-    - [Testing dependencies usages](#testing-dependencies-usages)
-    - [Testing components consuming the dependencies](#testing-components-consuming-the-dependencies)
-    - [Testing optional plugin dependencies](#testing-optional-plugin-dependencies)
-  - [RXJS testing](#rxjs-testing)
-    - [Testing RXJS observables with marble](#rxjs-testing-with-marble)
-    - [Precondition](#preconditions-2)
-    - [Examples](#example-5)
-      - [Testing an interval based observable](#testing-an-interval-based-observable)
-      - [Testing observable completion](#testing-observable-completion)
-      - [Testing observable errors](#testing-observable-errors)
-      - [Testing promise based observables](#testing-promise-based-observables)
-
-## Strategy
-
-In general, we recommend three tiers of tests:
-- Unit tests: small, fast, exhaustive, make heavy use of mocks for external dependencies 
-- Integration tests: higher-level tests that verify interactions between systems (eg. HTTP APIs, Elasticsearch API calls, calling other plugin contracts).
-- End-to-end tests (e2e): tests that verify user-facing behavior through the browser
-
-These tiers should roughly follow the traditional ["testing pyramid"](https://martinfowler.com/articles/practical-test-pyramid.html), where there are more exhaustive testing at the unit level, fewer at the integration level, and very few at the functional level. 
-
-## New concerns in the Kibana Platform
-
-The Kibana Platform introduces new concepts that legacy plugins did not have concern themselves with. Namely:
-- **Lifecycles**: plugins now have explicit lifecycle methods that must interop with Core APIs and other plugins.
-- **Shared runtime**: plugins now all run in the same process at the same time. On the frontend, this is different behavior than the legacy plugins. Developers should take care not to break other plugins when interacting with their enviornment (Node.js or Browser).
-- **Single page application**: Kibana's frontend is now a single-page application where all plugins are running, but only one application is mounted at a time. Plugins need to handle mounting and unmounting, cleanup, and avoid overriding global browser behaviors in this shared space.
-- **Dependency management**: plugins must now explicitly declare their dependencies on other plugins, both required and optional. Plugins should ensure to test conditions where a optional dependency is missing.
-
-Simply porting over existing tests when migrating your plugin to the Kibana Platform will leave blind spots in test coverage. It is highly recommended that plugins add new tests that cover these new concerns.
-
-## Core Integrations
-
-### Core Mocks
-
-When testing a plugin's integration points with Core APIs, it is heavily recommended to utilize the mocks provided in `src/core/server/mocks` and `src/core/public/mocks`. The majority of these mocks are dumb `jest` mocks that mimic the interface of their respective Core APIs, however they do not return realistic return values.
-
-If the unit under test expects a particular response from a Core API, the test will need to set this return value explicitly. The return values are type checked to match the Core API where possible to ensure that mocks are updated when Core APIs changed.
-
-#### Example
-
-```typescript
-import { elasticsearchServiceMock } from 'src/core/server/mocks';
-
-test('my test', async () => {
-  // Setup mock and faked response
-  const esClient = elasticsearchServiceMock.createScopedClusterClient();
-  esClient.callAsCurrentUser.mockResolvedValue(/** insert ES response here */);
-
-  // Call unit under test with mocked client
-  const result = await myFunction(esClient);
-
-  // Assert that client was called with expected arguments
-  expect(esClient.callAsCurrentUser).toHaveBeenCalledWith(/** expected args */);
-  // Expect that unit under test returns expected value based on client's response
-  expect(result).toEqual(/** expected return value */)
-});
-```
-
-## Strategies for specific Core APIs
-
-### HTTP Routes
-The HTTP API interface is another public contract of Kibana, although not every Kibana endpoint is for external use. When evaluating the required level of test coverage for an HTTP resource, make your judgment based on whether an endpoint is considered to be public or private. Public API is expected to have a higher level of test coverage.
-Public API tests should cover the **observable behavior** of the system, therefore they should be close to the real user interactions as much as possible, ideally by using HTTP requests to communicate with the Kibana server as a real user would do.
-
-##### Preconditions
-We are going to add tests for `myPlugin` plugin that allows to format user-provided text, store and retrieve it later.
-The plugin has *thin* route controllers isolating all the network layer dependencies and delegating all the logic to the plugin model.
-
-```typescript
-class TextFormatter {
-  public static async format(text: string, sanitizer: Deps['sanitizer']) {
-    // sanitizer.sanitize throws MisformedTextError when passed text contains HTML markup
-    const sanitizedText = await sanitizer.sanitize(text); 
-    return sanitizedText;
-  }
-
-  public static async save(text: string, savedObjectsClient: SavedObjectsClient) {
-    const { id } = await savedObjectsClient.update('myPlugin-type', 'myPlugin', {
-      userText: text
-    });
-    return { id };
-  }
-
-  public static async getById(id: string, savedObjectsClient: SavedObjectsClient) {
-    const { attributes } = await savedObjectsClient.get('myPlugin-type', id);
-    return { text: attributes.userText };
-  }
-}
-router.get(
-  {
-    path: '/myPlugin/formatter',
-    validate: {
-      query: schema.object({
-        text: schema.string({ maxLength: 100 }),
-      }),
-    },
-  },
-  async (context, request, response) => {
-    try {
-      const formattedText = await TextFormatter.format(request.query.text, deps.sanitizer);
-      return response.ok({ body: formattedText });
-    } catch(error) {
-      if (error instanceof MisformedTextError) {
-        return response.badRequest({ body: error.message })
-      }
-
-      throw e;
-    }
-  }
-);
-router.post(
-  {
-    path: '/myPlugin/formatter/text',
-    validate: {
-      body: schema.object({
-        text: schema.string({ maxLength: 100 }),
-      }),
-    },
-  },
-  async (context, request, response) => {
-    try {
-      const { id } = await TextFormatter.save(request.query.text, context.core.savedObjects.client);
-      return response.ok({ body: { id } });
-    } catch(error) {
-      if (SavedObjectsErrorHelpers.isConflictError(error)) {
-        return response.conflict({ body: error.message })
-      }
-      throw e;
-    }
-  }
-);
-
-router.get(
-  {
-    path: '/myPlugin/formatter/text/{id}',
-    validate: {
-      params: schema.object({
-        id: schema.string(),
-      }),
-    },
-  },
-  async (context, request, response) => {
-    try {
-      const { text } = await TextFormatter.getById(request.params.id, context.core.savedObjects.client);
-      return response.ok({
-        body: text
-      });
-    } catch(error) {
-      if (SavedObjectsErrorHelpers.isNotFoundError(error)) {
-        return response.notFound()
-      }
-      throw e;
-    }
-  }
-);
-```
-
-#### Unit testing
-Unit tests provide the simplest and fastest way to test the logic in your route controllers and plugin models. 
-Use them whenever adding an integration test is hard and slow due to complex setup or the number of logic permutations.
-Since all external core and plugin dependencies are mocked, you don't have the guarantee that the whole system works as
-expected.
-Pros:
-- fast
-- easier to debug
-
-Cons:
-- doesn't test against real dependencies
-- doesn't cover integration with other plugins
-
-###### Example
-You can leverage existing unit-test infrastructure for this. You should add `*.test.ts` file and use dependencies mocks to cover the functionality with a broader test suit that covers:
-- input permutations
-- input edge cases
-- expected exception
-- interaction with dependencies
-```typescript
-// src/plugins/my_plugin/server/formatter.test.ts
-describe('TextFormatter', () => {
-  describe('format()', () => {
-    const sanitizer = sanitizerMock.createSetup();
-    sanitizer.sanitize.mockImplementation((input: string) => `sanitizer result:${input}`);
-
-    it('formats text to a ... format', async () => {
-      expect(await TextFormatter.format('aaa', sanitizer)).toBe('...');
-    });
-
-    it('calls Sanitizer.sanitize with correct arguments', async () => {
-      await TextFormatter.format('aaa', sanitizer);
-      expect(sanitizer.sanitize).toHaveBeenCalledTimes(1);
-      expect(sanitizer.sanitize).toHaveBeenCalledWith('aaa');
-    });
-
-    it('throws MisformedTextError if passed string contains banned symbols', async () => {
-      sanitizer.sanitize.mockRejectedValueOnce(new MisformedTextError());
-      await expect(TextFormatter.format('any', sanitizer)).rejects.toThrow(MisformedTextError);
-    });
-    // ... other tests
-  });
-});
-```
-
-#### Integration tests
-Depending on the number of external dependencies, you can consider implementing several high-level integration tests. 
-They would work as a set of [smoke tests](https://en.wikipedia.org/wiki/Smoke_testing_(software)) for the most important functionality.
-Main subjects for tests should be:
-- authenticated / unauthenticated access to an endpoint.
-- endpoint validation (params, query, body).
-- main business logic.
-- dependencies on other plugins.
-
-##### Functional Test Runner
-If your plugin relies on the elasticsearch server to store data and supports additional configuration, you can leverage the Functional Test Runner(FTR) to implement integration tests. 
-FTR bootstraps an elasticsearch and a Kibana instance and runs the test suite against it.
-Pros:
-- runs the whole Elastic stack
-- tests cross-plugin integration
-- emulates a real user interaction with the stack
-- allows adjusting config values
-
-Cons:
-- slow start
-- hard to debug
-- brittle tests
-
-###### Example
-You can reuse existing [api_integration](/test/api_integration/config.js) setup by registering a test file within a [test loader](/test/api_integration/apis/index.js). More about the existing FTR setup in the [contribution guide](/CONTRIBUTING.md#running-specific-kibana-tests)
-
-The tests cover:
-- authenticated / non-authenticated user access (when applicable)
-```typescript
-// TODO after https://github.com/elastic/kibana/pull/53208/
-```
-- request validation
-```typescript
-// test/api_integration/apis/my_plugin/something.ts
-export default function({ getService }: FtrProviderContext) {
-  const supertest = getService('supertest');
-  describe('myPlugin', () => {
-    it('validate params before to store text', async () => {
-      const response = await supertest
-        .post('/myPlugin/formatter/text')
-        .set('content-type', 'application/json')
-        .send({ text: 'aaa'.repeat(100) })
-        .expect(400);
-
-      expect(response.body).to.have.property('message');
-      expect(response.body.message).to.contain('must have a maximum length of [100]');
-    });
-  });
-```
-- the main logic of the plugin
-```typescript
-export default function({ getService }: FtrProviderContext) {
-  const supertest = getService('supertest');
-  describe('myPlugin', () => {
-    it('stores text', async () => {
-      const response = await supertest
-        .post('/myPlugin/formatter/text')
-        .set('content-type', 'application/json')
-        .send({ text: 'aaa' })
-        .expect(200);
-
-      expect(response.body).to.have.property('id');
-      expect(response.body.id).to.be.a('string');
-    });
-
-    it('retrieves text', async () => {
-      const { body } = await supertest
-        .post('/myPlugin/formatter/text')
-        .set('content-type', 'application/json')
-        .send({ text: 'bbb' })
-        .expect(200);
-
-      const response = await supertest.get(`/myPlugin/formatter/text/${body.id}`).expect(200);
-      expect(response.text).be('bbb');
-    });
-
-    it('returns NotFound error when cannot find a text', async () => {
-      await supertest
-        .get('/myPlugin/something/missing')
-        .expect(404, 'Saved object [myPlugin-type/missing] not found');
-    });
-  });
-```
-
-##### TestUtils
-It can be utilized if your plugin doesn't interact with the elasticsearch server or mocks the own methods doing so.
-Runs tests against real Kibana server instance.
-Pros:
-- runs the real Kibana instance
-- tests cross-plugin integration
-- emulates a real user interaction with the HTTP resources
-
-Cons:
-- faster than FTR because it doesn't run elasticsearch instance, but still slow
-- hard to debug
-- doesn't cover Kibana CLI logic
-
-###### Example
-To have access to Kibana TestUtils, you should create `integration_tests` folder and import `test_utils` within a test file:
-```typescript
-// src/plugins/my_plugin/server/integration_tests/formatter.test.ts
-import * as kbnTestServer from 'src/core/test_helpers/kbn_server';
-
-describe('myPlugin', () => {
-  describe('GET /myPlugin/formatter', () => {
-    let root: ReturnType<typeof kbnTestServer.createRoot>;
-    beforeAll(async () => {
-      root = kbnTestServer.createRoot();
-      await root.preboot();
-      await root.setup();
-      await root.start();
-    }, 30000);
-
-    afterAll(async () => await root.shutdown());
-    it('validates given text', async () => {
-      const response = await kbnTestServer.request
-        .get(root, '/myPlugin/formatter')
-        .query({ text: 'input string'.repeat(100) })
-        .expect(400);
-
-      expect(response.body).toHaveProperty('message');
-    });
-
-    it('formats given text', async () => {
-      const response = await kbnTestServer.request
-        .get(root, '/myPlugin/formatter')
-        .query({ text: 'input string' })
-        .expect(200);
-
-      expect(response.text).toBe('...');
-    });
-
-    it('returns BadRequest if passed string contains banned symbols', async () => {
-      await kbnTestServer.request
-        .get(root, '/myPlugin/formatter')
-        .query({ text: '<script>' })
-        .expect(400, 'Text cannot contain unescaped HTML markup.');
-    });
-  });
-});
-```
-Sometimes we want to test a route controller logic and don't rely on the internal logic of the platform or a third-party plugin. 
-Then we can apply a hybrid approach and mock the necessary method of `TextFormatter` model to test how `MisformedTextError`
-handled in the route handler without calling `sanitizer` dependency directly.
-```typescript
-jest.mock('../path/to/model');
-import { TextFormatter } from '../path/to/model';
-import { MisformedTextError } from '../path/to/sanitizer'
-
-describe('myPlugin', () => {
-  describe('GET /myPlugin/formatter', () => {
-    let root: ReturnType<typeof kbnTestServer.createRoot>;
-    beforeAll(async () => {
-      root = kbnTestServer.createRoot();
-      await root.preboot();
-      await root.setup();
-      await root.start();
-    }, 30000);
-
-    afterAll(async () => await root.shutdown());
-    it('returns BadRequest if Sanitizer throws MisformedTextError', async () => {
-      TextFormatter.format.mockRejectedValueOnce(new MisformedTextError());
-
-      await kbnTestServer.request
-        .get(root, '/myPlugin/formatter')
-        .query({ text: 'any text' })
-        .expect(400, 'bad bad request');
-    });
-  });
-});
-```
-
-### Applications
-
-Kibana Platform applications have less control over the page than legacy applications did. It is important that your app is built to handle it's co-habitance with other plugins in the browser. Applications are mounted and unmounted from the DOM as the user navigates between them, without full-page refreshes, as a single-page application (SPA). 
-
-These long-lived sessions make cleanup more important than before. It's entirely possible a user has a single browsing session open for weeks at a time, without ever doing a full-page refresh. Common things that need to be cleaned up (and tested!) when your application is unmounted:
-- Subscriptions and polling (eg. `uiSettings.get$()`)
-- Any Core API calls that set state (eg. `core.chrome.setIsVisible`).
-- Open connections (eg. a Websocket)
-
-While applications do get an opportunity to unmount and run cleanup logic, it is also important that you do not _depend_ on this logic to run. The browser tab may get closed without running cleanup logic, so it is not guaranteed to be run. For instance, you should not depend on unmounting logic to run in order to save state to `localStorage` or to the backend.
-
-#### Example
-
-By following the [renderApp](./CONVENTIONS.md#applications) convention, you can greatly reduce the amount of logic in your application's mount function. This makes testing your application's actual rendering logic easier.
-
-```typescript jsx
-/** public/plugin.ts */
-class Plugin {
-  setup(core) {
-    core.application.register({
-      // id, title, etc.
-      async mount(params) {
-        const [{ renderApp }, [coreStart, startDeps]] = await Promise.all([
-          import('./application'),
-          core.getStartServices()
-        ]);
-
-        return renderApp(params, coreStart, startDeps);
-      }
-    })
-  }
-}
-```
-
-We _could_ still write tests for this logic, but you may find that you're just asserting the same things that would be covered by type-checks.
-
-<details>
-<summary>See example</summary>
-
-```typescript
-/** public/plugin.test.ts */
-jest.mock('./application', () => ({ renderApp: jest.fn() }));
-import { coreMock } from 'src/core/public/mocks';
-import { renderApp: renderAppMock } from './application';
-import { Plugin } from './plugin';
-
-describe('Plugin', () => {
-  it('registers an app', () => {
-    const coreSetup = coreMock.createSetup();
-    new Plugin(coreMock.createPluginInitializerContext()).setup(coreSetup);
-    expect(coreSetup.application.register).toHaveBeenCalledWith({
-      id: 'myApp',
-      mount: expect.any(Function)
-    });
-  });
-
-  // Test the glue code from Plugin -> renderApp
-  it('application.mount wires up dependencies to renderApp', async () => {
-    const coreSetup = coreMock.createSetup();
-    const [coreStartMock, startDepsMock] = await coreSetup.getStartServices();
-    const unmountMock = jest.fn();
-    renderAppMock.mockReturnValue(unmountMock);
-    const params = coreMock.createAppMountParamters('/fake/base/path');
-
-    new Plugin(coreMock.createPluginInitializerContext()).setup(coreSetup);
-    // Grab registered mount function
-    const mount = coreSetup.application.register.mock.calls[0][0].mount;
-
-    const unmount = await mount(params);
-    expect(renderAppMock).toHaveBeenCalledWith(params, coreStartMock, startDepsMock);
-    expect(unmount).toBe(unmountMock);
-  });
-});
-```
-
-</details>
-
-The more interesting logic is in `renderApp`:
-
-```typescript
-/** public/application.ts */
-import React from 'react';
-import ReactDOM from 'react-dom';
-
-import { AppMountParameters, CoreStart } from 'src/core/public';
-import { AppRoot } from './components/app_root';
-
-export const renderApp = (
-  { element, history }: AppMountParameters,
-  core: CoreStart,
-  plugins: MyPluginDepsStart
-) => {
-  // Hide the chrome while this app is mounted for a full screen experience
-  core.chrome.setIsVisible(false);
-
-  // uiSettings subscription
-  const uiSettingsClient = core.uiSettings.client;
-  const pollingSubscription = uiSettingClient.get$('mysetting1').subscribe(async mySetting1 => {
-    const value = core.http.fetch(/** use `mySetting1` in request **/);
-    // ...
-  });
-
-  // Render app
-  ReactDOM.render(
-    <AppRoot routerHistory={history} core={core} plugins={plugins} />,
-    element
-  );
-
-  return () => {
-    // Unmount UI
-    ReactDOM.unmountComponentAtNode(element);
-    // Close any subscriptions
-    pollingSubscription.unsubscribe();
-    // Make chrome visible again
-    core.chrome.setIsVisible(true);
-  };
-};
-```
-
-In testing `renderApp` you should be verifying that:
-1) Your application mounts and unmounts correctly
-2) Cleanup logic is completed as expected
-
-```typescript
-/** public/application.test.ts */
-import { createMemoryHistory } from 'history';
-import { ScopedHistory } from 'src/core/public';
-import { coreMock } from 'src/core/public/mocks';
-import { renderApp } from './application';
-
-describe('renderApp', () => {
-  it('mounts and unmounts UI', () => {
-    const params = coreMock.createAppMountParamters('/fake/base/path');
-    const core = coreMock.createStart();
-
-    // Verify some expected DOM element is rendered into the element
-    const unmount = renderApp(params, core, {});
-    expect(params.element.querySelector('.some-app-class')).not.toBeUndefined();
-    // Verify the element is empty after unmounting
-    unmount();
-    expect(params.element.innerHTML).toEqual('');
-  });
-
-  it('unsubscribes from uiSettings', () => {
-    const params = coreMock.createAppMountParamters('/fake/base/path');
-    const core = coreMock.createStart();
-    // Create a fake Subject you can use to monitor observers
-    const settings$ = new Subject();
-    core.uiSettings.get$.mockReturnValue(settings$);
-
-    // Verify mounting adds an observer
-    const unmount = renderApp(params, core, {});
-    expect(settings$.observers.length).toBe(1);
-    // Verify no observers remaining after unmount is called
-    unmount();
-    expect(settings$.observers.length).toBe(0);
-  });
-
-  it('resets chrome visibility', () => {
-    const params = coreMock.createAppMountParamters('/fake/base/path');
-    const core = coreMock.createStart();
-
-    // Verify stateful Core API was called on mount
-    const unmount = renderApp(params, core, {});
-    expect(core.chrome.setIsVisible).toHaveBeenCalledWith(false);
-    core.chrome.setIsVisible.mockClear(); // reset mock
-    // Verify stateful Core API was called on unmount
-    unmount();
-    expect(core.chrome.setIsVisible).toHaveBeenCalledWith(true);
-  })
-});
-```
-
-### SavedObjects
-
-#### Unit Tests
-
-To unit test code that uses the Saved Objects client mock the client methods
-and make assertions against the behaviour you would expect to see.
-
-Since the Saved Objects client makes network requests to an external
-Elasticsearch cluster, it's important to include failure scenarios in your
-test cases.
-
-When writing a view with which a user might interact, it's important to ensure
-your code can recover from exceptions and provide a way for the user to
-proceed. This behaviour should be tested as well.
-
-Below is an example of a Jest Unit test suite that mocks the server-side Saved
-Objects client:
-
-```typescript
-// src/plugins/myplugin/server/lib/short_url_lookup.ts
-import crypto from 'crypto';
-import { SavedObjectsClientContract } from 'kibana/server';
-
-export const shortUrlLookup = {
-  generateUrlId(url: string, savedObjectsClient: SavedObjectsClientContract) {
-    const id = crypto
-      .createHash('md5')
-      .update(url)
-      .digest('hex');
-
-    return savedObjectsClient
-      .create(
-        'url',
-        {
-          url,
-          accessCount: 0,
-          createDate: new Date().valueOf(),
-          accessDate: new Date().valueOf(),
-        },
-        { id }
-      )
-      .then(doc => doc.id)
-      .catch(err => {
-        if (savedObjectsClient.errors.isConflictError(err)) {
-          return id;
-        } else {
-          throw err;
-        }
-      });
-  },
-};
-
-```
-
-```typescript
-// src/plugins/myplugin/server/lib/short_url_lookup.test.ts
-import { shortUrlLookup } from './short_url_lookup';
-import { savedObjectsClientMock } from '../../../../../core/server/mocks';
-
-describe('shortUrlLookup', () => {
-  const ID = 'bf00ad16941fc51420f91a93428b27a0';
-  const TYPE = 'url';
-  const URL = 'http://elastic.co';
-
-  const mockSavedObjectsClient = savedObjectsClientMock.create();
-
-  beforeEach(() => {
-    jest.resetAllMocks();
-  });
-
-  describe('generateUrlId', () => {
-    it('provides correct arguments to savedObjectsClient', async () => {
-      const ATTRIBUTES = {
-        url: URL,
-        accessCount: 0,
-        createDate: new Date().valueOf(),
-        accessDate: new Date().valueOf(),
-      };
-      mockSavedObjectsClient.create.mockResolvedValueOnce({
-        id: ID,
-        type: TYPE,
-        references: [],
-        attributes: ATTRIBUTES,
-      });
-      await shortUrlLookup.generateUrlId(URL, mockSavedObjectsClient);
-
-      expect(mockSavedObjectsClient.create).toHaveBeenCalledTimes(1);
-      const [type, attributes, options] = mockSavedObjectsClient.create.mock.calls[0];
-      expect(type).toBe(TYPE);
-      expect(attributes).toStrictEqual(ATTRIBUTES);
-      expect(options).toStrictEqual({ id: ID });
-    });
-
-    it('ignores version conflict and returns id', async () => {
-      mockSavedObjectsClient.create.mockRejectedValueOnce(
-        mockSavedObjectsClient.errors.decorateConflictError(new Error())
-      );
-      const id = await shortUrlLookup.generateUrlId(URL, mockSavedObjectsClient);
-      expect(id).toEqual(ID);
-    });
-
-    it('rejects with passed through savedObjectsClient errors', () => {
-      const error = new Error('oops');
-      mockSavedObjectsClient.create.mockRejectedValueOnce(error);
-      return expect(shortUrlLookup.generateUrlId(URL, mockSavedObjectsClient)).rejects.toBe(error);
-    });
-  });
-});
-```
-
-The following is an example of a public saved object unit test. The biggest
-difference with the server-side test is the slightly different Saved Objects
-client API which returns `SimpleSavedObject` instances which needs to be
-reflected in the mock.
-
-```typescript
-// src/plugins/myplugin/public/saved_query_service.ts
-import {
-  SavedObjectsClientContract,
-  SavedObjectAttributes,
-  SimpleSavedObject,
-} from 'src/core/public';
-
-export type SavedQueryAttributes = SavedObjectAttributes & {
-  title: string;
-  description: 'bar';
-  query: {
-    language: 'kuery';
-    query: 'response:200';
-  };
-};
-
-export const createSavedQueryService = (savedObjectsClient: SavedObjectsClientContract) => {
-  const saveQuery = async (
-    attributes: SavedQueryAttributes
-  ): Promise<SimpleSavedObject<SavedQueryAttributes>> => {
-    try {
-      return await savedObjectsClient.create<SavedQueryAttributes>('query', attributes, {
-        id: attributes.title as string,
-      });
-    } catch (err) {
-      throw new Error('Unable to create saved query, please try again.');
-    }
-  };
-
-  return {
-    saveQuery,
-  };
-};
-```
-
-```typescript
-// src/plugins/myplugin/public/saved_query_service.test.ts
-import { createSavedQueryService, SavedQueryAttributes } from './saved_query_service';
-import { savedObjectsServiceMock } from '../../../../../core/public/mocks';
-import { SavedObjectsClientContract, SimpleSavedObject } from '../../../../../core/public';
-
-describe('saved query service', () => {
-  const savedQueryAttributes: SavedQueryAttributes = {
-    title: 'foo',
-    description: 'bar',
-    query: {
-      language: 'kuery',
-      query: 'response:200',
-    },
-  };
-
-  const mockSavedObjectsClient = savedObjectsServiceMock.createStartContract()
-    .client as jest.Mocked<SavedObjectsClientContract>;
-
-  const savedQueryService = createSavedQueryService(mockSavedObjectsClient);
-
-  afterEach(() => {
-    jest.resetAllMocks();
-  });
-
-  describe('saveQuery', function() {
-    it('should create a saved object for the given attributes', async () => {
-      // The public Saved Objects client returns instances of
-      // SimpleSavedObject, so we create an instance to return from our mock.
-      const mockReturnValue = new SimpleSavedObject(mockSavedObjectsClient, {
-        type: 'query',
-        id: 'foo',
-        attributes: savedQueryAttributes,
-        references: [],
-      });
-      mockSavedObjectsClient.create.mockResolvedValue(mockReturnValue);
-
-      const response = await savedQueryService.saveQuery(savedQueryAttributes);
-      expect(mockSavedObjectsClient.create).toHaveBeenCalledWith('query', savedQueryAttributes, {
-        id: 'foo',
-      });
-      expect(response).toBe(mockReturnValue);
-    });
-
-    it('should reject with an error when saved objects client errors', async done => {
-      mockSavedObjectsClient.create.mockRejectedValue(new Error('timeout'));
-
-      try {
-        await savedQueryService.saveQuery(savedQueryAttributes);
-      } catch (err) {
-        expect(err).toMatchInlineSnapshot(
-          `[Error: Unable to create saved query, please try again.]`
-        );
-        done();
-      }
-    });
-  });
-});
-```
-
-#### Integration Tests
-To get the highest confidence in how your code behaves when using the Saved
-Objects client, you should write at least a few integration tests which loads
-data into and queries a real Elasticsearch database.
-
-To do that we'll write a Jest integration test using `TestUtils` to start
-Kibana and esArchiver to load fixture data into Elasticsearch.
-
-1. Create the fixtures data you need in Elasticsearch
-2. Create a fixtures archive with `node scripts/es_archiver save <path> [index patterns...]`
-3. Load the fixtures in your test using esArchiver `esArchiver.load('path from root of repo')`;
-
-_todo: fully worked out example_
-
-### Elasticsearch
-
-_How to test ES clients_
-
-## Plugin integrations
-
-In the new platform, all plugin's dependencies to other plugins are explicitly declared in their `kibana.json`
-manifest. As for `core`, the dependencies `setup` and `start` contracts are injected in your plugin's respective 
-`setup` and `start` phases. One of the upsides with testing is that every usage of the dependencies is explicit,
-and that the plugin's contracts must be propagated to the parts of the code using them, meaning that isolating a 
-specific logical component for unit testing is way easier than in legacy.
-
-The approach to test parts of a plugin's code that is relying on other plugins is quite similar to testing
-code using `core` APIs: it's expected to mock the dependency, and make it return the value the test is expecting.
-
-Most plugins are defining mocks for their contracts. The convention is to expose them in a `mocks` file  in 
-`my_plugin/server` and/or `my_plugin/public`. For example for the `data` plugin, the client-side mocks are located in 
-`src/plugins/data/public/mocks.ts`. When such mocks are present, it's strongly recommended to use them
-when testing against dependencies. Otherwise, one should create it's own mocked implementation of the dependency's
-contract (and should probably ping the plugin's owner to ask them to add proper contract mocks).
-
-### Preconditions
-
-For these examples, we are going to see how we should test the `myPlugin` plugin.
- 
-This plugin declares the `data` plugin as  a `required` dependency and the `usageCollection` plugin as an `optional` 
-one. It also exposes a `getSpecialSuggestions` API in it's start contract, which relies on the `data` plugin to retrieve
-data.
-
-`MyPlugin` plugin definition:
-
-```typescript
-// src/plugins/myplugin/public/plugin.ts
-import { METRIC_TYPE } from '@kbn/analytics';
-import { CoreSetup, CoreStart, Plugin } from 'kibana/public';
-import { DataPublicPluginSetup, DataPublicPluginStart } from '../../data/public';
-import { UsageCollectionSetup } from '../../usage_collection/public';
-import { SuggestionsService } from './suggestions';
-
-interface MyPluginSetupDeps {
-  data: DataPublicPluginSetup;
-  usageCollection?: UsageCollectionSetup;
-}
-
-interface MyPluginStartDeps {
-  data: DataPublicPluginStart;
-}
-
-export class MyPlugin implements Plugin<MyPluginSetup, MyPluginStart, MyPluginSetupDeps, MyPluginStartDeps> {
-  private suggestionsService = new SuggestionsService();
-
-  public setup(core: CoreSetup, { data, usageCollection }: MyPluginSetupDeps) {
-    // setup our internal service
-    this.suggestionsService.setup(data);
-
-    // an example on using an optional dependency that will be tested
-    if (usageCollection) {
-      usageCollection.reportUiCounter('my_plugin', METRIC_TYPE.LOADED, 'my_event');
-    }
-    // or in a shorter version
-    usageCollection?.reportUiCounter('my_plugin', METRIC_TYPE.LOADED, 'my_event');
-
-    return {};
-  }
-
-  public start(core: CoreStart, { data }: MyPluginStartDeps) {
-    const suggestions = this.suggestionsService.start(data);
-    return {
-      getSpecialSuggestions: (query: string) => suggestions.getSuggestions(query),
-    };
-  }
-
-  public stop() {}
-}
-
-export type MyPluginSetup = ReturnType<MyPlugin['setup']>;
-export type MyPluginStart = ReturnType<MyPlugin['start']>;
-```
-
-The underlying `SuggestionsService` implementation:
-
-```typescript
-// src/plugins/myplugin/public/suggestions/suggestion_service.ts
-import { DataPublicPluginSetup, DataPublicPluginStart } from '../../../data/public';
-
-// stubs for testing purposes
-const suggestDependingOn = (...args: any[]) => [];
-const baseOptions = {} as any;
-export const defaultSuggestions = [
-  {
-    text: 'a default suggestion',
-  },
-] as any[];
-
-export class SuggestionsService {
-  public setup(data: DataPublicPluginSetup) {
-    // register a suggestion provider to the `data` dependency plugin
-    data.autocomplete.addQuerySuggestionProvider('fr', async args => {
-      return suggestDependingOn(args);
-    });
-  }
-
-  public start(data: DataPublicPluginStart) {
-    return {
-      getSuggestions: async (query: string) => {
-        // use the `data` plugin contract to retrieve arbitrary data
-        // note: this logic does not really make any sense and is only here to introduce a behavior to test
-        const baseSuggestions = await data.autocomplete.getQuerySuggestions({
-          ...baseOptions,
-          query,
-        });
-        if (!baseSuggestions || baseSuggestions.length === 0) {
-          return defaultSuggestions;
-        }
-        return baseSuggestions.filter(suggestion => suggestion.type !== 'conjunction');
-      },
-    };
-  }
-}
-```
-
-### Testing dependencies usages
-
-A plugin should test expected usage and calls on it's dependency plugins' API.
-
-Some calls, such as 'registration' APIs exposed from dependency plugins, should be checked,
-to ensure both that they are actually executed, and performed with the correct parameters.
-
-For our example plugin's `SuggestionsService`, we should assert that the suggestion provider is correctly 
-registered to the `data` plugin during the `setup` phase, and that `getSuggestions` calls 
-`autocomplete.getQuerySuggestions` with the correct parameters.
-
-```typescript
-// src/plugins/myplugin/public/suggestions/suggestion_service.test.ts
-import {
-  dataPluginMock,
-  Setup as DataPluginSetupMock,
-  Start as DataPluginStartMock,
-} from '../../../data/public/mocks';
-import { SuggestionsService } from './suggestion_service';
-
-describe('SuggestionsService', () => {
-  let service: SuggestionsService;
-  let dataSetup: DataPluginSetupMock;
-  let dataStart: DataPluginStartMock;
-
-  beforeEach(() => {
-    service = new SuggestionsService();
-    dataSetup = dataPluginMock.createSetupContract();
-    dataStart = dataPluginMock.createStartContract();
-  });
-
-  describe('#setup', () => {
-    it('registers the query suggestion provider to the data plugin', () => {
-      service.setup(dataSetup);
-
-      expect(dataSetup.autocomplete.addQuerySuggestionProvider).toHaveBeenCalledTimes(1);
-      expect(dataSetup.autocomplete.addQuerySuggestionProvider).toHaveBeenCalledWith(
-        'fr',
-        expect.any(Function)
-      );
-    });
-  });
-
-  describe('#start', () => {
-    describe('#getSuggestions', () => {
-      it('calls getQuerySuggestions with the correct query', async () => {
-        service.setup(dataSetup);
-        const serviceStart = service.start(dataStart);
-
-        await serviceStart.getSuggestions('some query');
-
-        expect(dataStart.autocomplete.getQuerySuggestions).toHaveBeenCalledTimes(1);
-        expect(dataStart.autocomplete.getQuerySuggestions).toHaveBeenCalledWith(
-          expect.objectContaining({
-            query: 'some query',
-          })
-        );
-      });
-    });
-  });
-});
-```
-
-### Testing components consuming the dependencies
-
-When testing parts of your plugin code that depends on the dependency plugin's data, the best approach
-is to mock the dependency to be able to get the behavior expected for the test.
-
-In this example, we are going to mock the results of `autocomplete.getQuerySuggestions` to be able to test 
-the service's `getSuggestions` method.
-
-```typescript
-// src/plugins/myplugin/public/suggestions/suggestion_service.ts
-
-describe('#start', () => {
-  describe('#getSuggestions', () => {
-    it('returns the default suggestions when autocomplete returns no results', async () => {
-      dataStart.autocomplete.getQuerySuggestions.mockResolvedValue([]);
-
-      service.setup(dataSetup);
-      const serviceStart = service.start(dataStart);
-
-      const results = await serviceStart.getSuggestions('some query');
-      expect(results).toEqual(defaultSuggestions);
-    });
-
-    it('excludes conjunctions from the autocomplete results', async () => {
-      dataStart.autocomplete.getQuerySuggestions.mockResolvedValue([
-        {
-          type: 'field',
-          text: 'field suggestion',
-        },
-        {
-          type: 'conjunction',
-          text: 'conjunction suggestion',
-        },
-      ]);
-
-      service.setup(dataSetup);
-      const serviceStart = service.start(dataStart);
-
-      const results = await serviceStart.getSuggestions('some query');
-
-      expect(results).toEqual([
-        {
-          type: 'field',
-          text: 'field suggestion',
-        },
-      ]);
-    });
-  });
-});
-```
-
-### Testing optional plugin dependencies
-
-Plugins should test that their behavior remains correct when their optional dependencies are either available or not.
-
-A basic test would be to ensure that the plugin properly initialize without error when the optional
-dependency is missing:
-
-```typescript
-// src/plugins/myplugin/public/plugin.test.ts
-import { coreMock } from '../../../core/public/mocks';
-import { dataPluginMock } from '../../data/public/mocks';
-import { MyPlugin } from './plugin';
-
-describe('Plugin', () => {
-  it('initializes correctly if usageCollection is disabled', () => {
-    const plugin = new MyPlugin(coreMock.createPluginInitializerContext());
-    const coreSetup = coreMock.createSetup();
-    const setupDeps = {
-      data: dataPluginMock.createSetupContract(),
-      // optional usageCollector dependency is not available
-    };
-  
-    const coreStart = coreMock.createStart();
-    const startDeps = {
-      data: dataPluginMock.createStartContract(),
-    };
-  
-    expect(() => {
-      plugin.setup(coreSetup, setupDeps);
-    }).not.toThrow();
-    expect(() => {
-      plugin.start(coreStart, startDeps);
-    }).not.toThrow();
-  });
-});
-```
-
-Then we should test that when optional dependency is properly used when present:
-
-```typescript
-// src/plugins/myplugin/public/plugin.test.ts
-import { coreMock } from '../../../core/public/mocks';
-import { dataPluginMock } from '../../data/public/mocks';
-import { usageCollectionPluginMock } from '../../usage_collection/public/mocks';
-
-import { METRIC_TYPE } from '@kbn/analytics';
-
-import { MyPlugin } from './plugin';
-
-describe('Plugin', () => {
-  // [...]
-
-  it('enables trackUserAgent when usageCollection is available', async () => {
-    const plugin = new MyPlugin(coreMock.createPluginInitializerContext());
-    const coreSetup = coreMock.createSetup();
-    const usageCollectionSetup = usageCollectionPluginMock.createSetupContract();
-    const setupDeps = {
-      data: dataPluginMock.createSetupContract(),
-      usageCollection: usageCollectionSetup,
-    };
-
-    plugin.setup(coreSetup, setupDeps);
-
-    expect(usageCollectionSetup.reportUiCounter).toHaveBeenCalledTimes(2);
-    expect(usageCollectionSetup.reportUiCounter).toHaveBeenCalledWith('my_plugin', METRIC_TYPE.LOADED, 'my_event');
-  });
-});
-```
-
-## RXJS testing
-
-### Testing RXJS observables with marble
-
-Testing observable based APIs can be challenging, specially when asynchronous operators or sources are used, 
-or when trying to assert against emission's timing.
-
-Fortunately, RXJS comes with it's own `marble` testing module to greatly facilitate that kind of testing.
-
-See [the official doc](https://rxjs-dev.firebaseapp.com/guide/testing/marble-testing) for more information about marble testing.
-
-### Preconditions
-
-The following examples all assume that the following snippet is included in every test file:
-
-```typescript
-import { TestScheduler } from 'rxjs/testing';
-
-const getTestScheduler = () =>
-  new TestScheduler((actual, expected) => {
-    expect(actual).toEqual(expected);
-  });
-```
-
-`getTestScheduler` creates a `TestScheduler` that is wired on `jest`'s `expect` statement when comparing an observable's time frame.
-
-### Examples
-
-#### Testing an interval based observable
-
-Here is a very basic example of an interval-based API:
-
-```typescript
-class FooService {
-  setup() {
-    return {
-      getUpdate$: () => {
-        return interval(100).pipe(map((count) => `update-${count + 1}`));
-      },
-    };
-  }
-}
-```
-
-If we were to be adding a test that asserts the correct behavior of this API without using marble testing, it
-would probably be something like:
-
-```typescript
-it('getUpdate$ emits updates every 100ms', async () => {
-  const service = new FooService();
-  const { getUpdate$ } = service.setup();
-  expect(await getUpdate$().pipe(take(3), toArray()).toPromise()).toEqual([
-    'update-1',
-    'update-2',
-    'update-3',
-  ]);
-});
-```
-
-Note that if we are able to test the correct value of each emission, we don't have any way to assert that
-the interval of 100ms was respected. Even using a subscription based test to try to do so would result
-in potential flakiness, as the subscription execution could trigger on the `101ms` time frame for example.
-
-It also may be important to note:
-- as we need to convert the observable to a promise and wait for the result, the test is `async`
-- we need to perform observable transformation (`take` + `toArray`) in the test to have an usable value to assert against.
-
-Marble testing would allow to get rid of these limitations. An equivalent and improved marble test could be:
-
-```typescript
-  describe('getUpdate$', () => {
-    it('emits updates every 100ms', () => {
-      getTestScheduler().run(({ expectObservable }) => {
-        const { getUpdate$ } = service.setup();
-        expectObservable(getUpdate$(), '301ms !').toBe('100ms a 99ms b 99ms c', {
-          a: 'update-1',
-          b: 'update-2',
-          c: 'update-3',
-        });
-      });
-    });
-  });
-```
-
-Notes:
-- the test is now synchronous
-- the second parameter of `expectObservable` (`'301ms !'`) is used to perform manual unsubscription to the observable, as 
-  `interval` never ends.
-- an emission is considered a time frame, meaning that after the initial `a` emission, we are at the frame `101`, not `100`
-  which is why we are then only using a `99ms` gap between a->b and b->c.
-
-#### Testing observable completion
-
-Let's 'improve' our `getUpdate$` API by allowing the consumer to manually terminate the observable chain using
-a new `abort$` option:
-
-```typescript
-class FooService {
-  setup() {
-    return {
-      // note: using an abortion observable is usually an anti-pattern, as unsubscribing from the observable
-      // is, most of the time, a better solution. This is only used for the example purpose.
-      getUpdate$: ({ abort$ = EMPTY }: { abort$?: Observable<undefined> } = {}) => {
-        return interval(100).pipe(
-            takeUntil(abort$), 
-            map((count) => `update-${count + 1}`)
-        );
-      },
-    };
-  }
-}
-```
-
-We would then add a test to assert than this new option usage is respected:
-
-```typescript
-it('getUpdate$ completes when `abort$` emits', () => {
-  const service = new FooService();
-  getTestScheduler().run(({ expectObservable, hot }) => {
-    const { getUpdate$ } = service.setup();
-    const abort$ = hot('149ms a', { a: undefined });
-    expectObservable(getUpdate$({ abort$ })).toBe('100ms a 48ms |', {
-      a: 'update-1',
-    });
-  });
-});
-```
-
-Notes:
-  - the `|` symbol represents the completion of the observable.
-  - we are here using the `hot` testing utility to create the `abort$` observable to ensure correct emission timing.
- 
-#### Testing observable errors 
-
-Testing errors thrown by the observable is very close to the previous examples and is done using
-the third parameter of `expectObservable`.
-
-Say we have a service in charge of processing data from an observable and returning the results in a new observable:
-
-```typescript
-interface SomeDataType {
-  id: string;
-}
-
-class BarService {
-  setup() {
-    return {
-      processDataStream: (data$: Observable<SomeDataType>) => {
-        return data$.pipe(
-          map((data) => {
-            if (data.id === 'invalid') {
-              throw new Error(`invalid data: '${data.id}'`);
-            }
-            return {
-              ...data,
-              processed: 'additional-data',
-            };
-          })
-        );
-      },
-    };
-  }
-}
-```
- 
-We could write a test that asserts the service properly emit processed results until an invalid data is encountered:
- 
-```typescript
-it('processDataStream throw an error when processing invalid data', () => {
-  getTestScheduler().run(({ expectObservable, hot }) => {
-    const service = new BarService();
-    const { processDataStream } = service.setup();
-
-    const data = hot('--a--b--(c|)', {
-      a: { id: 'a' },
-      b: { id: 'invalid' },
-      c: { id: 'c' },
-    });
-
-    expectObservable(processDataStream(data)).toBe(
-      '--a--#',
-      {
-        a: { id: 'a', processed: 'additional-data' },
-      },
-      `'[Error: invalid data: 'invalid']'`
-    );
-  });
-});
-```
-
-Notes:
- - the `-` symbol represents one virtual time frame.
- - the `#` symbol represents an error.
- - when throwing custom `Error` classes, the assertion can be against an error instance, but this doesn't work
-   with base errors.
- 
-#### Testing promise based observables
-
-In some cases, the observable we want to test is based on a Promise (like `of(somePromise).pipe(...)`). This can occur
-when using promise-based services, such as core's `http`, for instance.
-
-```typescript
-export const callServerAPI = (
-  http: HttpStart,
-  body: Record<string, any>,
-  { abort$ }: { abort$: Observable<undefined> }
-): Observable<SomeResponse> => {
-  let controller: AbortController | undefined;
-  if (abort$) {
-    controller = new AbortController();
-    abort$.subscribe(() => {
-      controller!.abort();
-    });
-  }
-  return from(
-    http.post<SomeResponse>('/api/endpoint', {
-      body,
-      signal: controller?.signal,
-    })
-  ).pipe(
-    takeUntil(abort$ ?? EMPTY),
-    map((response) => response.results)
-  );
-};
-```
-
-Testing that kind of promise based observable does not work out of the box with marble testing, as the asynchronous promise resolution
-is not handled by the test scheduler's 'sandbox'.
-
-Fortunately, there are workarounds for this problem. The most common one being to mock the promise-returning API to return
-an observable instead for testing, as `of(observable)` also works and returns the input observable. 
-
-Note that when doing so, the test suite must also include tests using a real promise value to ensure correct behavior in real situation.
-
-```typescript
-
-// NOTE: test scheduler do not properly work with promises because of their asynchronous nature.
-// we are cheating here by having `http.post` return an observable instead of a promise.
-// this still allows more finely grained testing about timing, and asserting that the method
-// works properly when `post` returns a real promise is handled in other tests of this suite
-
-it('callServerAPI result observable emits when the response is received', () => {
-  const http = httpServiceMock.createStartContract();
-  getTestScheduler().run(({ expectObservable, hot }) => {
-    // need to cast the observable as `any` because http.post.mockReturnValue expects a promise, see previous comment
-    http.post.mockReturnValue(hot('---(a|)', { a: { someData: 'foo' } }) as any);
-
-    const results = callServerAPI(http, { query: 'term' }, {});
-
-    expectObservable(results).toBe('---(a|)', {
-      a: { someData: 'foo' },
-    });
-  });
-});
-
-it('completes without returning results if aborted$ emits before the response', () => {
-  const http = httpServiceMock.createStartContract();
-  getTestScheduler().run(({ expectObservable, hot }) => {
-    // need to cast the observable as `any` because http.post.mockReturnValue expects a promise, see previous comment
-    http.post.mockReturnValue(hot('---(a|)', { a: { someData: 'foo' } }) as any);
-    const aborted$ = hot('-(a|)', { a: undefined });
-    const results = callServerAPI(http, { query: 'term' }, { aborted$ });
-
-    expectObservable(results).toBe('-|');
-  });
-});
-```
\ No newline at end of file
+Moved to [../../dev_docs/tutorials/testing_plugins.mdx](../../dev_docs/tutorials/testing_plugins.mdx)
diff --git a/src/core/public/chrome/ui/header/__snapshots__/header.test.tsx.snap b/src/core/public/chrome/ui/header/__snapshots__/header.test.tsx.snap
index af836d4436a1a1..d2bc11f4db8772 100644
--- a/src/core/public/chrome/ui/header/__snapshots__/header.test.tsx.snap
+++ b/src/core/public/chrome/ui/header/__snapshots__/header.test.tsx.snap
@@ -4843,20 +4843,29 @@ exports[`Header renders 1`] = `
                 truncate={true}
               >
                 <nav
-                  aria-label="breadcrumb"
+                  aria-label="Breadcrumbs"
                   className="euiBreadcrumbs euiHeaderBreadcrumbs euiBreadcrumbs--truncate"
                   data-test-subj="breadcrumbs"
                 >
-                  <EuiInnerText>
-                    <span
-                      aria-current="page"
+                  <ol
+                    className="euiBreadcrumbs__list"
+                  >
+                    <li
                       className="euiBreadcrumb euiBreadcrumb--last"
-                      data-test-subj="breadcrumb first last"
-                      title="test"
+                      key="0"
                     >
-                      test
-                    </span>
-                  </EuiInnerText>
+                      <EuiInnerText>
+                        <span
+                          aria-current="page"
+                          className="euiBreadcrumb__content"
+                          data-test-subj="breadcrumb first last"
+                          title="test"
+                        >
+                          test
+                        </span>
+                      </EuiInnerText>
+                    </li>
+                  </ol>
                 </nav>
               </EuiBreadcrumbs>
             </EuiHeaderBreadcrumbs>
diff --git a/src/core/public/chrome/ui/header/__snapshots__/header_breadcrumbs.test.tsx.snap b/src/core/public/chrome/ui/header/__snapshots__/header_breadcrumbs.test.tsx.snap
index 5080b23e99c252..eb90df831fabc6 100644
--- a/src/core/public/chrome/ui/header/__snapshots__/header_breadcrumbs.test.tsx.snap
+++ b/src/core/public/chrome/ui/header/__snapshots__/header_breadcrumbs.test.tsx.snap
@@ -1,34 +1,54 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`HeaderBreadcrumbs renders updates to the breadcrumbs$ observable 1`] = `
-<span
-  aria-current="page"
+<li
   className="euiBreadcrumb euiBreadcrumb--last"
-  data-test-subj="breadcrumb first last"
-  title="First"
+  key="0"
 >
-  First
-</span>
+  <EuiInnerText>
+    <span
+      aria-current="page"
+      className="euiBreadcrumb__content"
+      data-test-subj="breadcrumb first last"
+      title="First"
+    >
+      First
+    </span>
+  </EuiInnerText>
+</li>
 `;
 
 exports[`HeaderBreadcrumbs renders updates to the breadcrumbs$ observable 2`] = `
 Array [
-  <span
-    aria-current="false"
+  <li
     className="euiBreadcrumb"
-    data-test-subj="breadcrumb first"
-    title="First"
+    key="0"
   >
-    First
-  </span>,
-  <span
-    aria-current="page"
+    <EuiInnerText>
+      <span
+        className="euiBreadcrumb__content"
+        data-test-subj="breadcrumb first"
+        title="First"
+      >
+        First
+      </span>
+    </EuiInnerText>
+  </li>,
+  <li
     className="euiBreadcrumb euiBreadcrumb--last"
-    data-test-subj="breadcrumb last"
-    title="Second"
+    key="1"
   >
-    Second
-  </span>,
+    <EuiInnerText>
+      <span
+        aria-current="page"
+        className="euiBreadcrumb__content"
+        data-test-subj="breadcrumb last"
+        title="Second"
+      >
+        Second
+      </span>
+    </EuiInnerText>
+  </li>,
 ]
 `;
 
diff --git a/src/core/public/i18n/__snapshots__/i18n_service.test.tsx.snap b/src/core/public/i18n/__snapshots__/i18n_service.test.tsx.snap
index cd8c669aae2358..f723cf5bca23af 100644
--- a/src/core/public/i18n/__snapshots__/i18n_service.test.tsx.snap
+++ b/src/core/public/i18n/__snapshots__/i18n_service.test.tsx.snap
@@ -17,7 +17,8 @@ exports[`#start() returns \`Context\` component 1`] = `
           "euiBottomBar.customScreenReaderAnnouncement": [Function],
           "euiBottomBar.screenReaderAnnouncement": "There is a new region landmark with page level controls at the end of the document.",
           "euiBottomBar.screenReaderHeading": "Page level controls",
-          "euiBreadcrumbs.collapsedBadge.ariaLabel": "Show collapsed breadcrumbs",
+          "euiBreadcrumbs.collapsedBadge.ariaLabel": "See collapsed breadcrumbs",
+          "euiBreadcrumbs.nav.ariaLabel": "Breadcrumbs",
           "euiCardSelect.select": "Select",
           "euiCardSelect.selected": "Selected",
           "euiCardSelect.unavailable": "Unavailable",
@@ -193,11 +194,13 @@ exports[`#start() returns \`Context\` component 1`] = `
           "euiSelectableTemplateSitewide.searchPlaceholder": "Search for anything...",
           "euiStat.loadingText": "Statistic is loading",
           "euiStepStrings.complete": [Function],
+          "euiStepStrings.current": [Function],
           "euiStepStrings.disabled": [Function],
           "euiStepStrings.errors": [Function],
           "euiStepStrings.incomplete": [Function],
           "euiStepStrings.loading": [Function],
           "euiStepStrings.simpleComplete": [Function],
+          "euiStepStrings.simpleCurrent": [Function],
           "euiStepStrings.simpleDisabled": [Function],
           "euiStepStrings.simpleErrors": [Function],
           "euiStepStrings.simpleIncomplete": [Function],
diff --git a/src/core/public/i18n/i18n_eui_mapping.tsx b/src/core/public/i18n/i18n_eui_mapping.tsx
index 3372146894edbf..0a6c7a05e1c75e 100644
--- a/src/core/public/i18n/i18n_eui_mapping.tsx
+++ b/src/core/public/i18n/i18n_eui_mapping.tsx
@@ -92,10 +92,14 @@ export const getEuiContextMapping = (): EuiTokensObject => {
     'euiBreadcrumbs.collapsedBadge.ariaLabel': i18n.translate(
       'core.euiBreadcrumbs.collapsedBadge.ariaLabel',
       {
-        defaultMessage: 'Show collapsed breadcrumbs',
+        defaultMessage: 'See collapsed breadcrumbs',
         description: 'Displayed when one or more breadcrumbs are hidden.',
       }
     ),
+    'euiBreadcrumbs.nav.ariaLabel': i18n.translate('core.euiBreadcrumbs.nav.ariaLabel', {
+      defaultMessage: 'Breadcrumbs',
+      description: 'Label on the breadcrumbs nav element',
+    }),
     'euiCardSelect.select': i18n.translate('core.euiCardSelect.select', {
       defaultMessage: 'Select',
       description: 'Displayed button text when a card option can be selected.',
@@ -932,11 +936,21 @@ export const getEuiContextMapping = (): EuiTokensObject => {
         defaultMessage: 'Step {number}: {title} is complete',
         values: { number, title },
       }),
+    'euiStepStrings.current': ({ number, title }: EuiValues) =>
+      i18n.translate('core.euiStepStrings.current', {
+        defaultMessage: 'Current step {number}: {title}',
+        values: { number, title },
+      }),
     'euiStepStrings.simpleComplete': ({ number }: EuiValues) =>
       i18n.translate('core.euiStepStrings.simpleComplete', {
         defaultMessage: 'Step {number} is complete',
         values: { number },
       }),
+    'euiStepStrings.simpleCurrent': ({ number }: EuiValues) =>
+      i18n.translate('core.euiStepStrings.simpleCurrent', {
+        defaultMessage: 'Current step is {number}',
+        values: { number },
+      }),
     'euiStepStrings.warning': ({ number, title }: EuiValues) =>
       i18n.translate('core.euiStepStrings.warning', {
         defaultMessage: 'Step {number}: {title} has warnings',
diff --git a/src/core/public/overlays/flyout/flyout_service.tsx b/src/core/public/overlays/flyout/flyout_service.tsx
index 603736f08268f0..b41b85e5f429f1 100644
--- a/src/core/public/overlays/flyout/flyout_service.tsx
+++ b/src/core/public/overlays/flyout/flyout_service.tsx
@@ -84,6 +84,7 @@ export interface OverlayFlyoutOpenOptions {
   'data-test-subj'?: string;
   size?: EuiFlyoutSize;
   maxWidth?: boolean | number | string;
+  hideCloseButton?: boolean;
 }
 
 interface StartDeps {
diff --git a/src/core/public/public.api.md b/src/core/public/public.api.md
index 8e0087cbeeed09..80fd3927e05a36 100644
--- a/src/core/public/public.api.md
+++ b/src/core/public/public.api.md
@@ -1027,6 +1027,8 @@ export interface OverlayFlyoutOpenOptions {
     // (undocumented)
     closeButtonAriaLabel?: string;
     // (undocumented)
+    hideCloseButton?: boolean;
+    // (undocumented)
     maxWidth?: boolean | number | string;
     // (undocumented)
     ownFocus?: boolean;
diff --git a/src/core/server/elasticsearch/client/configure_client.ts b/src/core/server/elasticsearch/client/configure_client.ts
index 18c9724c2f8f43..f2953862c25e0f 100644
--- a/src/core/server/elasticsearch/client/configure_client.ts
+++ b/src/core/server/elasticsearch/client/configure_client.ts
@@ -50,6 +50,12 @@ export const configureClient = (
   const client = new Client({ ...clientOptions, Transport: KibanaTransport });
   addLogging(client, logger.get('query', type));
 
+  // ------------------------------------------------------------------------ //
+  // Hack to disable the "Product check" while the bugs in                    //
+  // https://github.com/elastic/kibana/issues/105557 are handled.             //
+  skipProductCheck(client);
+  // ------------------------------------------------------------------------ //
+
   return client;
 };
 
@@ -112,3 +118,21 @@ const addLogging = (client: Client, logger: Logger) => {
     }
   });
 };
+
+/**
+ * Hack to skip the Product Check performed by the Elasticsearch-js client.
+ * We noticed a couple of bugs that may need to be fixed before taking full
+ * advantage of this feature.
+ *
+ * The bugs are detailed in this issue: https://github.com/elastic/kibana/issues/105557
+ *
+ * The hack is copied from the test/utils in the elasticsearch-js repo
+ * (https://github.com/elastic/elasticsearch-js/blob/master/test/utils/index.js#L45-L56)
+ */
+function skipProductCheck(client: Client) {
+  const tSymbol = Object.getOwnPropertySymbols(client.transport || client).filter(
+    (symbol) => symbol.description === 'product check'
+  )[0];
+  // @ts-expect-error `tSymbol` is missing in the index signature of Transport
+  (client.transport || client)[tSymbol] = 2;
+}
diff --git a/src/core/server/plugins/plugin.test.ts b/src/core/server/plugins/plugin.test.ts
index 610bc1cac5a3be..31706e01e4b84a 100644
--- a/src/core/server/plugins/plugin.test.ts
+++ b/src/core/server/plugins/plugin.test.ts
@@ -39,6 +39,11 @@ jest.doMock(join('plugin-with-wrong-initializer-path', 'server'), () => ({ plugi
   virtual: true,
 });
 
+const OSS_PLUGIN_PATH_POSIX = '/kibana/src/plugins/ossPlugin';
+const OSS_PLUGIN_PATH_WINDOWS = 'C:\\kibana\\src\\plugins\\ossPlugin';
+const XPACK_PLUGIN_PATH_POSIX = '/kibana/x-pack/plugins/xPackPlugin';
+const XPACK_PLUGIN_PATH_WINDOWS = 'C:\\kibana\\x-pack\\plugins\\xPackPlugin';
+
 function createPluginManifest(manifestProps: Partial<PluginManifest> = {}): PluginManifest {
   return {
     id: 'some-plugin-id',
@@ -97,10 +102,49 @@ test('`constructor` correctly initializes plugin instance', () => {
   expect(plugin.name).toBe('some-plugin-id');
   expect(plugin.configPath).toBe('path');
   expect(plugin.path).toBe('some-plugin-path');
+  expect(plugin.source).toBe('external'); // see below for test cases for non-external sources (OSS and X-Pack)
   expect(plugin.requiredPlugins).toEqual(['some-required-dep']);
   expect(plugin.optionalPlugins).toEqual(['some-optional-dep']);
 });
 
+describe('`constructor` correctly sets non-external source', () => {
+  function createPlugin(path: string) {
+    const manifest = createPluginManifest();
+    const opaqueId = Symbol();
+    return new PluginWrapper({
+      path,
+      manifest,
+      opaqueId,
+      initializerContext: createPluginInitializerContext(
+        coreContext,
+        opaqueId,
+        manifest,
+        instanceInfo
+      ),
+    });
+  }
+
+  test('for OSS plugin in POSIX', () => {
+    const plugin = createPlugin(OSS_PLUGIN_PATH_POSIX);
+    expect(plugin.source).toBe('oss');
+  });
+
+  test('for OSS plugin in Windows', () => {
+    const plugin = createPlugin(OSS_PLUGIN_PATH_WINDOWS);
+    expect(plugin.source).toBe('oss');
+  });
+
+  test('for X-Pack plugin in POSIX', () => {
+    const plugin = createPlugin(XPACK_PLUGIN_PATH_POSIX);
+    expect(plugin.source).toBe('x-pack');
+  });
+
+  test('for X-Pack plugin in Windows', () => {
+    const plugin = createPlugin(XPACK_PLUGIN_PATH_WINDOWS);
+    expect(plugin.source).toBe('x-pack');
+  });
+});
+
 test('`setup` fails if `plugin` initializer is not exported', () => {
   const manifest = createPluginManifest();
   const opaqueId = Symbol();
diff --git a/src/core/server/plugins/plugin.ts b/src/core/server/plugins/plugin.ts
index 76ed4f8f24b3d4..dc861b4489dcf3 100644
--- a/src/core/server/plugins/plugin.ts
+++ b/src/core/server/plugins/plugin.ts
@@ -27,6 +27,9 @@ import {
 } from './types';
 import { CorePreboot, CoreSetup, CoreStart } from '..';
 
+const OSS_PATH_REGEX = /[\/|\\]src[\/|\\]plugins[\/|\\]/; // Matches src/plugins directory on POSIX and Windows
+const XPACK_PATH_REGEX = /[\/|\\]x-pack[\/|\\]plugins[\/|\\]/; // Matches x-pack/plugins directory on POSIX and Windows
+
 /**
  * Lightweight wrapper around discovered plugin that is responsible for instantiating
  * plugin and dispatching proper context and dependencies into plugin's lifecycle hooks.
@@ -40,6 +43,7 @@ export class PluginWrapper<
   TPluginsStart extends object = object
 > {
   public readonly path: string;
+  public readonly source: 'oss' | 'x-pack' | 'external';
   public readonly manifest: PluginManifest;
   public readonly opaqueId: PluginOpaqueId;
   public readonly name: PluginManifest['id'];
@@ -70,6 +74,7 @@ export class PluginWrapper<
     }
   ) {
     this.path = params.path;
+    this.source = getPluginSource(params.path);
     this.manifest = params.manifest;
     this.opaqueId = params.opaqueId;
     this.initializerContext = params.initializerContext;
@@ -204,3 +209,12 @@ export class PluginWrapper<
     return this.manifest.type === PluginType.preboot;
   }
 }
+
+function getPluginSource(path: string): 'oss' | 'x-pack' | 'external' {
+  if (OSS_PATH_REGEX.test(path)) {
+    return 'oss';
+  } else if (XPACK_PATH_REGEX.test(path)) {
+    return 'x-pack';
+  }
+  return 'external';
+}
diff --git a/src/core/server/plugins/plugins_service.test.ts b/src/core/server/plugins/plugins_service.test.ts
index 3cd645cb74ac00..a9827dc60fb781 100644
--- a/src/core/server/plugins/plugins_service.test.ts
+++ b/src/core/server/plugins/plugins_service.test.ts
@@ -52,6 +52,15 @@ expect.addSnapshotSerializer(createAbsolutePathSerializer());
   });
 });
 
+const OSS_PLUGIN_PATH = '/kibana/src/plugins/ossPlugin';
+const XPACK_PLUGIN_PATH = '/kibana/x-pack/plugins/xPackPlugin';
+const EXTERNAL_PLUGIN_PATH = '/kibana/plugins/externalPlugin';
+[OSS_PLUGIN_PATH, XPACK_PLUGIN_PATH, EXTERNAL_PLUGIN_PATH].forEach((path) => {
+  jest.doMock(join(path, 'server'), () => ({}), {
+    virtual: true,
+  });
+});
+
 const createPlugin = (
   id: string,
   {
@@ -247,6 +256,75 @@ describe('PluginsService', () => {
       expect(standardMockPluginSystem.setupPlugins).not.toHaveBeenCalled();
     });
 
+    describe('X-Pack dependencies', () => {
+      function mockDiscoveryResults(params: { sourcePluginPath: string; dependencyType: string }) {
+        const { sourcePluginPath, dependencyType } = params;
+        // Each plugin's source is derived from its path; the PluginWrapper test suite contains more detailed test cases around the paths (for both POSIX and Windows)
+        mockDiscover.mockReturnValue({
+          error$: from([]),
+          plugin$: from([
+            createPlugin('sourcePlugin', {
+              path: sourcePluginPath,
+              version: 'some-version',
+              configPath: 'path',
+              requiredPlugins: dependencyType === 'requiredPlugin' ? ['xPackPlugin'] : [],
+              requiredBundles: dependencyType === 'requiredBundle' ? ['xPackPlugin'] : undefined,
+              optionalPlugins: dependencyType === 'optionalPlugin' ? ['xPackPlugin'] : [],
+            }),
+            createPlugin('xPackPlugin', {
+              path: XPACK_PLUGIN_PATH,
+              version: 'some-version',
+              configPath: 'path',
+              requiredPlugins: [],
+              optionalPlugins: [],
+            }),
+          ]),
+        });
+      }
+
+      async function expectError() {
+        await expect(pluginsService.discover({ environment: environmentPreboot })).rejects.toThrow(
+          `X-Pack plugin or bundle with id "xPackPlugin" is required by OSS plugin "sourcePlugin", which is prohibited. Consider making this an optional dependency instead.`
+        );
+        expect(standardMockPluginSystem.addPlugin).not.toHaveBeenCalled();
+      }
+      async function expectSuccess() {
+        await expect(pluginsService.discover({ environment: environmentPreboot })).resolves.toEqual(
+          expect.anything()
+        );
+        expect(standardMockPluginSystem.addPlugin).toHaveBeenCalled();
+      }
+
+      it('throws if an OSS plugin requires an X-Pack plugin or bundle', async () => {
+        for (const dependencyType of ['requiredPlugin', 'requiredBundle']) {
+          mockDiscoveryResults({ sourcePluginPath: OSS_PLUGIN_PATH, dependencyType });
+          await expectError();
+        }
+      });
+
+      it('does not throw if an OSS plugin has an optional dependency on an X-Pack plugin', async () => {
+        mockDiscoveryResults({
+          sourcePluginPath: OSS_PLUGIN_PATH,
+          dependencyType: 'optionalPlugin',
+        });
+        await expectSuccess();
+      });
+
+      it('does not throw if an X-Pack plugin depends on an X-Pack plugin or bundle', async () => {
+        for (const dependencyType of ['requiredPlugin', 'requiredBundle', 'optionalPlugin']) {
+          mockDiscoveryResults({ sourcePluginPath: XPACK_PLUGIN_PATH, dependencyType });
+          await expectSuccess();
+        }
+      });
+
+      it('does not throw if an external plugin depends on an X-Pack plugin or bundle', async () => {
+        for (const dependencyType of ['requiredPlugin', 'requiredBundle', 'optionalPlugin']) {
+          mockDiscoveryResults({ sourcePluginPath: EXTERNAL_PLUGIN_PATH, dependencyType });
+          await expectSuccess();
+        }
+      });
+    });
+
     it('properly detects plugins that should be disabled.', async () => {
       jest
         .spyOn(configService, 'isEnabledAtPath')
diff --git a/src/core/server/plugins/plugins_service.ts b/src/core/server/plugins/plugins_service.ts
index 05bb60fb22c6db..9def7554ccd09e 100644
--- a/src/core/server/plugins/plugins_service.ts
+++ b/src/core/server/plugins/plugins_service.ts
@@ -314,27 +314,7 @@ export class PluginsService implements CoreService<PluginsServiceSetup, PluginsS
       .toPromise();
 
     for (const [pluginName, { plugin, isEnabled }] of pluginEnableStatuses) {
-      // validate that `requiredBundles` ids point to a discovered plugin which `includesUiPlugin`
-      for (const requiredBundleId of plugin.requiredBundles) {
-        if (!pluginEnableStatuses.has(requiredBundleId)) {
-          throw new Error(
-            `Plugin bundle with id "${requiredBundleId}" is required by plugin "${pluginName}" but it is missing.`
-          );
-        }
-
-        const requiredPlugin = pluginEnableStatuses.get(requiredBundleId)!.plugin;
-        if (!requiredPlugin.includesUiPlugin) {
-          throw new Error(
-            `Plugin bundle with id "${requiredBundleId}" is required by plugin "${pluginName}" but it doesn't have a UI bundle.`
-          );
-        }
-
-        if (requiredPlugin.manifest.type !== plugin.manifest.type) {
-          throw new Error(
-            `Plugin bundle with id "${requiredBundleId}" is required by plugin "${pluginName}" and expected to have "${plugin.manifest.type}" type, but its type is "${requiredPlugin.manifest.type}".`
-          );
-        }
-      }
+      this.validatePluginDependencies(plugin, pluginEnableStatuses);
 
       const pluginEnablement = this.shouldEnablePlugin(pluginName, pluginEnableStatuses);
 
@@ -358,6 +338,48 @@ export class PluginsService implements CoreService<PluginsServiceSetup, PluginsS
     this.log.debug(`Discovered ${pluginEnableStatuses.size} plugins.`);
   }
 
+  /** Throws an error if the plugin's dependencies are invalid. */
+  private validatePluginDependencies(
+    plugin: PluginWrapper,
+    pluginEnableStatuses: Map<PluginName, { plugin: PluginWrapper; isEnabled: boolean }>
+  ) {
+    const { name, manifest, requiredBundles, requiredPlugins } = plugin;
+
+    // validate that `requiredBundles` ids point to a discovered plugin which `includesUiPlugin`
+    for (const requiredBundleId of requiredBundles) {
+      if (!pluginEnableStatuses.has(requiredBundleId)) {
+        throw new Error(
+          `Plugin bundle with id "${requiredBundleId}" is required by plugin "${name}" but it is missing.`
+        );
+      }
+
+      const requiredPlugin = pluginEnableStatuses.get(requiredBundleId)!.plugin;
+      if (!requiredPlugin.includesUiPlugin) {
+        throw new Error(
+          `Plugin bundle with id "${requiredBundleId}" is required by plugin "${name}" but it doesn't have a UI bundle.`
+        );
+      }
+
+      if (requiredPlugin.manifest.type !== plugin.manifest.type) {
+        throw new Error(
+          `Plugin bundle with id "${requiredBundleId}" is required by plugin "${name}" and expected to have "${manifest.type}" type, but its type is "${requiredPlugin.manifest.type}".`
+        );
+      }
+    }
+
+    // validate that OSS plugins do not have required dependencies on X-Pack plugins
+    if (plugin.source === 'oss') {
+      for (const id of [...requiredPlugins, ...requiredBundles]) {
+        const requiredPlugin = pluginEnableStatuses.get(id);
+        if (requiredPlugin && requiredPlugin.plugin.source === 'x-pack') {
+          throw new Error(
+            `X-Pack plugin or bundle with id "${id}" is required by OSS plugin "${name}", which is prohibited. Consider making this an optional dependency instead.`
+          );
+        }
+      }
+    }
+  }
+
   private shouldEnablePlugin(
     pluginName: PluginName,
     pluginEnableStatuses: Map<PluginName, { plugin: PluginWrapper; isEnabled: boolean }>,
diff --git a/src/core/server/saved_objects/migrations/core/document_migrator.test.mock.ts b/src/core/server/saved_objects/migrations/core/document_migrator.test.mock.ts
new file mode 100644
index 00000000000000..ee0b18af5ac0dc
--- /dev/null
+++ b/src/core/server/saved_objects/migrations/core/document_migrator.test.mock.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+const mockGetConvertedObjectId = jest.fn().mockReturnValue('uuidv5');
+jest.mock('../../service/lib/utils', () => {
+  const actual = jest.requireActual('../../service/lib/utils');
+  return {
+    ...actual,
+    SavedObjectsUtils: {
+      ...actual.SavedObjectsUtils,
+      getConvertedObjectId: mockGetConvertedObjectId,
+    },
+  };
+});
+
+export { mockGetConvertedObjectId };
diff --git a/src/core/server/saved_objects/migrations/core/document_migrator.test.ts b/src/core/server/saved_objects/migrations/core/document_migrator.test.ts
index 87b8ee08090641..64c1c4ce2fa9fb 100644
--- a/src/core/server/saved_objects/migrations/core/document_migrator.test.ts
+++ b/src/core/server/saved_objects/migrations/core/document_migrator.test.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { mockUuidv5 } from './__mocks__';
+import { mockGetConvertedObjectId } from './document_migrator.test.mock';
 import { set } from '@elastic/safer-lodash-set';
 import _ from 'lodash';
 import { SavedObjectUnsanitizedDoc } from '../../serialization';
@@ -37,7 +37,7 @@ const createRegistry = (...types: Array<Partial<SavedObjectsType>>) => {
 };
 
 beforeEach(() => {
-  mockUuidv5.mockClear();
+  mockGetConvertedObjectId.mockClear();
 });
 
 describe('DocumentMigrator', () => {
@@ -866,7 +866,7 @@ describe('DocumentMigrator', () => {
           namespace: 'foo-namespace',
         };
         const actual = migrator.migrate(obj);
-        expect(mockUuidv5).not.toHaveBeenCalled();
+        expect(mockGetConvertedObjectId).not.toHaveBeenCalled();
         expect(actual).toEqual({
           id: 'cowardly',
           type: 'dog',
@@ -898,7 +898,7 @@ describe('DocumentMigrator', () => {
 
         it('in the default space', () => {
           const actual = migrator.migrateAndConvert(obj);
-          expect(mockUuidv5).not.toHaveBeenCalled();
+          expect(mockGetConvertedObjectId).not.toHaveBeenCalled();
           expect(actual).toEqual([
             {
               id: 'bad',
@@ -912,8 +912,8 @@ describe('DocumentMigrator', () => {
 
         it('in a non-default space', () => {
           const actual = migrator.migrateAndConvert({ ...obj, namespace: 'foo-namespace' });
-          expect(mockUuidv5).toHaveBeenCalledTimes(1);
-          expect(mockUuidv5).toHaveBeenCalledWith('foo-namespace:toy:favorite', 'DNSUUID');
+          expect(mockGetConvertedObjectId).toHaveBeenCalledTimes(1);
+          expect(mockGetConvertedObjectId).toHaveBeenCalledWith('foo-namespace', 'toy', 'favorite');
           expect(actual).toEqual([
             {
               id: 'bad',
@@ -946,7 +946,7 @@ describe('DocumentMigrator', () => {
 
         it('in the default space', () => {
           const actual = migrator.migrateAndConvert(obj);
-          expect(mockUuidv5).not.toHaveBeenCalled();
+          expect(mockGetConvertedObjectId).not.toHaveBeenCalled();
           expect(actual).toEqual([
             {
               id: 'loud',
@@ -961,8 +961,8 @@ describe('DocumentMigrator', () => {
 
         it('in a non-default space', () => {
           const actual = migrator.migrateAndConvert({ ...obj, namespace: 'foo-namespace' });
-          expect(mockUuidv5).toHaveBeenCalledTimes(1);
-          expect(mockUuidv5).toHaveBeenCalledWith('foo-namespace:dog:loud', 'DNSUUID');
+          expect(mockGetConvertedObjectId).toHaveBeenCalledTimes(1);
+          expect(mockGetConvertedObjectId).toHaveBeenCalledWith('foo-namespace', 'dog', 'loud');
           expect(actual).toEqual([
             {
               id: 'uuidv5',
@@ -1008,7 +1008,7 @@ describe('DocumentMigrator', () => {
 
         it('in the default space', () => {
           const actual = migrator.migrateAndConvert(obj);
-          expect(mockUuidv5).not.toHaveBeenCalled();
+          expect(mockGetConvertedObjectId).not.toHaveBeenCalled();
           expect(actual).toEqual([
             {
               id: 'cute',
@@ -1024,9 +1024,19 @@ describe('DocumentMigrator', () => {
 
         it('in a non-default space', () => {
           const actual = migrator.migrateAndConvert({ ...obj, namespace: 'foo-namespace' });
-          expect(mockUuidv5).toHaveBeenCalledTimes(2);
-          expect(mockUuidv5).toHaveBeenNthCalledWith(1, 'foo-namespace:toy:favorite', 'DNSUUID');
-          expect(mockUuidv5).toHaveBeenNthCalledWith(2, 'foo-namespace:dog:cute', 'DNSUUID');
+          expect(mockGetConvertedObjectId).toHaveBeenCalledTimes(2);
+          expect(mockGetConvertedObjectId).toHaveBeenNthCalledWith(
+            1,
+            'foo-namespace',
+            'toy',
+            'favorite'
+          );
+          expect(mockGetConvertedObjectId).toHaveBeenNthCalledWith(
+            2,
+            'foo-namespace',
+            'dog',
+            'cute'
+          );
           expect(actual).toEqual([
             {
               id: 'uuidv5',
@@ -1080,7 +1090,7 @@ describe('DocumentMigrator', () => {
 
         it('in the default space', () => {
           const actual = migrator.migrateAndConvert(obj);
-          expect(mockUuidv5).not.toHaveBeenCalled();
+          expect(mockGetConvertedObjectId).not.toHaveBeenCalled();
           expect(actual).toEqual([
             {
               id: 'sleepy',
@@ -1095,8 +1105,8 @@ describe('DocumentMigrator', () => {
 
         it('in a non-default space', () => {
           const actual = migrator.migrateAndConvert({ ...obj, namespace: 'foo-namespace' });
-          expect(mockUuidv5).toHaveBeenCalledTimes(1);
-          expect(mockUuidv5).toHaveBeenCalledWith('foo-namespace:toy:favorite', 'DNSUUID');
+          expect(mockGetConvertedObjectId).toHaveBeenCalledTimes(1);
+          expect(mockGetConvertedObjectId).toHaveBeenCalledWith('foo-namespace', 'toy', 'favorite');
           expect(actual).toEqual([
             {
               id: 'sleepy',
@@ -1134,7 +1144,7 @@ describe('DocumentMigrator', () => {
 
         it('in the default space', () => {
           const actual = migrator.migrateAndConvert(obj);
-          expect(mockUuidv5).not.toHaveBeenCalled();
+          expect(mockGetConvertedObjectId).not.toHaveBeenCalled();
           expect(actual).toEqual([
             {
               id: 'hungry',
@@ -1149,8 +1159,8 @@ describe('DocumentMigrator', () => {
 
         it('in a non-default space', () => {
           const actual = migrator.migrateAndConvert({ ...obj, namespace: 'foo-namespace' });
-          expect(mockUuidv5).toHaveBeenCalledTimes(1);
-          expect(mockUuidv5).toHaveBeenCalledWith('foo-namespace:dog:hungry', 'DNSUUID');
+          expect(mockGetConvertedObjectId).toHaveBeenCalledTimes(1);
+          expect(mockGetConvertedObjectId).toHaveBeenCalledWith('foo-namespace', 'dog', 'hungry');
           expect(actual).toEqual([
             {
               id: 'uuidv5',
@@ -1204,7 +1214,7 @@ describe('DocumentMigrator', () => {
 
         it('in the default space', () => {
           const actual = migrator.migrateAndConvert(obj);
-          expect(mockUuidv5).not.toHaveBeenCalled();
+          expect(mockGetConvertedObjectId).not.toHaveBeenCalled();
           expect(actual).toEqual([
             {
               id: 'pretty',
@@ -1220,9 +1230,19 @@ describe('DocumentMigrator', () => {
 
         it('in a non-default space', () => {
           const actual = migrator.migrateAndConvert({ ...obj, namespace: 'foo-namespace' });
-          expect(mockUuidv5).toHaveBeenCalledTimes(2);
-          expect(mockUuidv5).toHaveBeenNthCalledWith(1, 'foo-namespace:toy:favorite', 'DNSUUID');
-          expect(mockUuidv5).toHaveBeenNthCalledWith(2, 'foo-namespace:dog:pretty', 'DNSUUID');
+          expect(mockGetConvertedObjectId).toHaveBeenCalledTimes(2);
+          expect(mockGetConvertedObjectId).toHaveBeenNthCalledWith(
+            1,
+            'foo-namespace',
+            'toy',
+            'favorite'
+          );
+          expect(mockGetConvertedObjectId).toHaveBeenNthCalledWith(
+            2,
+            'foo-namespace',
+            'dog',
+            'pretty'
+          );
           expect(actual).toEqual([
             {
               id: 'uuidv5',
diff --git a/src/core/server/saved_objects/migrations/core/document_migrator.ts b/src/core/server/saved_objects/migrations/core/document_migrator.ts
index 23f5d075d72e37..040aa81cdab3a7 100644
--- a/src/core/server/saved_objects/migrations/core/document_migrator.ts
+++ b/src/core/server/saved_objects/migrations/core/document_migrator.ts
@@ -65,7 +65,7 @@ import { MigrationLogger } from './migration_logger';
 import { TransformSavedObjectDocumentError } from '.';
 import { ISavedObjectTypeRegistry } from '../../saved_objects_type_registry';
 import { SavedObjectMigrationFn, SavedObjectMigrationMap } from '../types';
-import { DEFAULT_NAMESPACE_STRING } from '../../service/lib/utils';
+import { DEFAULT_NAMESPACE_STRING, SavedObjectsUtils } from '../../service/lib/utils';
 import { LegacyUrlAlias, LEGACY_URL_ALIAS_TYPE } from '../../object_types';
 
 const DEFAULT_MINIMUM_CONVERT_VERSION = '8.0.0';
@@ -556,7 +556,7 @@ function convertNamespaceType(doc: SavedObjectUnsanitizedDoc) {
   }
 
   const { id: originId, type } = otherAttrs;
-  const id = deterministicallyRegenerateObjectId(namespace, type, originId!);
+  const id = SavedObjectsUtils.getConvertedObjectId(namespace, type, originId!);
   if (namespace !== undefined) {
     const legacyUrlAlias: SavedObjectUnsanitizedDoc<LegacyUrlAlias> = {
       id: `${namespace}:${type}:${originId}`,
@@ -616,7 +616,9 @@ function getReferenceTransforms(typeRegistry: ISavedObjectTypeRegistry): Transfo
             references: references.map(({ type, id, ...attrs }) => ({
               ...attrs,
               type,
-              id: types.has(type) ? deterministicallyRegenerateObjectId(namespace, type, id) : id,
+              id: types.has(type)
+                ? SavedObjectsUtils.getConvertedObjectId(namespace, type, id)
+                : id,
             })),
           },
           additionalDocs: [],
diff --git a/src/core/server/saved_objects/migrations/core/__mocks__/index.ts b/src/core/server/saved_objects/service/lib/utils.test.mock.ts
similarity index 80%
rename from src/core/server/saved_objects/migrations/core/__mocks__/index.ts
rename to src/core/server/saved_objects/service/lib/utils.test.mock.ts
index d290bc57e26697..9e2b5c66bc91a9 100644
--- a/src/core/server/saved_objects/migrations/core/__mocks__/index.ts
+++ b/src/core/server/saved_objects/service/lib/utils.test.mock.ts
@@ -6,8 +6,11 @@
  * Side Public License, v 1.
  */
 
+const mockUuidv1 = jest.fn().mockReturnValue('uuidv1');
+jest.mock('uuid/v1', () => mockUuidv1);
+
 const mockUuidv5 = jest.fn().mockReturnValue('uuidv5');
 Object.defineProperty(mockUuidv5, 'DNS', { value: 'DNSUUID', writable: false });
 jest.mock('uuid/v5', () => mockUuidv5);
 
-export { mockUuidv5 };
+export { mockUuidv1, mockUuidv5 };
diff --git a/src/core/server/saved_objects/service/lib/utils.test.ts b/src/core/server/saved_objects/service/lib/utils.test.ts
index 7101eafc72a32e..0f502d8bfb9f14 100644
--- a/src/core/server/saved_objects/service/lib/utils.test.ts
+++ b/src/core/server/saved_objects/service/lib/utils.test.ts
@@ -6,14 +6,11 @@
  * Side Public License, v 1.
  */
 
-import uuid from 'uuid';
+import { mockUuidv1, mockUuidv5 } from './utils.test.mock';
+
 import { SavedObjectsFindOptions } from '../../types';
 import { SavedObjectsUtils } from './utils';
 
-jest.mock('uuid', () => ({
-  v1: jest.fn().mockReturnValue('mock-uuid'),
-}));
-
 describe('SavedObjectsUtils', () => {
   const {
     namespaceIdToString,
@@ -21,6 +18,7 @@ describe('SavedObjectsUtils', () => {
     createEmptyFindResponse,
     generateId,
     isRandomId,
+    getConvertedObjectId,
   } = SavedObjectsUtils;
 
   describe('#namespaceIdToString', () => {
@@ -80,8 +78,8 @@ describe('SavedObjectsUtils', () => {
 
   describe('#generateId', () => {
     it('returns a valid uuid', () => {
-      expect(generateId()).toBe('mock-uuid');
-      expect(uuid.v1).toHaveBeenCalled();
+      expect(generateId()).toBe('uuidv1'); // default return value for mockUuidv1
+      expect(mockUuidv1).toHaveBeenCalled();
     });
   });
 
@@ -93,4 +91,20 @@ describe('SavedObjectsUtils', () => {
       expect(isRandomId(undefined)).toBe(false);
     });
   });
+
+  describe('#getConvertedObjectId', () => {
+    it('does not change the object ID if namespace is undefined or "default"', () => {
+      for (const namespace of [undefined, 'default']) {
+        const result = getConvertedObjectId(namespace, 'type', 'oldId');
+        expect(result).toBe('oldId');
+        expect(mockUuidv5).not.toHaveBeenCalled();
+      }
+    });
+
+    it('changes the object ID if namespace is defined and not "default"', () => {
+      const result = getConvertedObjectId('namespace', 'type', 'oldId');
+      expect(result).toBe('uuidv5'); // default return value for mockUuidv5
+      expect(mockUuidv5).toHaveBeenCalledWith('namespace:type:oldId', 'DNSUUID');
+    });
+  });
 });
diff --git a/src/core/server/saved_objects/service/lib/utils.ts b/src/core/server/saved_objects/service/lib/utils.ts
index 494ac6ce9fad5e..6942b3b3762329 100644
--- a/src/core/server/saved_objects/service/lib/utils.ts
+++ b/src/core/server/saved_objects/service/lib/utils.ts
@@ -6,7 +6,8 @@
  * Side Public License, v 1.
  */
 
-import uuid from 'uuid';
+import uuidv1 from 'uuid/v1';
+import uuidv5 from 'uuid/v5';
 import { SavedObjectsFindOptions } from '../../types';
 import { SavedObjectsFindResponse } from '..';
 
@@ -65,7 +66,7 @@ export class SavedObjectsUtils {
    * Generates a random ID for a saved objects.
    */
   public static generateId() {
-    return uuid.v1();
+    return uuidv1();
   }
 
   /**
@@ -77,4 +78,19 @@ export class SavedObjectsUtils {
   public static isRandomId(id: string | undefined) {
     return typeof id === 'string' && UUID_REGEX.test(id);
   }
+
+  /**
+   * Uses a single-namespace object's "legacy ID" to determine what its new ID will be after it is converted to a multi-namespace type.
+   *
+   * @param {string} namespace The namespace of the saved object before it is converted.
+   * @param {string} type The type of the saved object before it is converted.
+   * @param {string} id The ID of the saved object before it is converted.
+   * @returns {string} The ID of the saved object after it is converted.
+   */
+  public static getConvertedObjectId(namespace: string | undefined, type: string, id: string) {
+    if (SavedObjectsUtils.namespaceIdToString(namespace) === DEFAULT_NAMESPACE_STRING) {
+      return id; // Objects that exist in the Default space do not get new IDs when they are converted.
+    }
+    return uuidv5(`${namespace}:${type}:${id}`, uuidv5.DNS); // The uuidv5 namespace constant (uuidv5.DNS) is arbitrary.
+  }
 }
diff --git a/src/core/server/server.api.md b/src/core/server/server.api.md
index fbc51acfdc8ef6..7f2ce38a5bdd49 100644
--- a/src/core/server/server.api.md
+++ b/src/core/server/server.api.md
@@ -3163,6 +3163,7 @@ export interface SavedObjectsUpdateResponse<T = unknown> extends Omit<SavedObjec
 export class SavedObjectsUtils {
     static createEmptyFindResponse: <T, A>({ page, perPage, }: SavedObjectsFindOptions) => SavedObjectsFindResponse<T, A>;
     static generateId(): string;
+    static getConvertedObjectId(namespace: string | undefined, type: string, id: string): string;
     static isRandomId(id: string | undefined): boolean;
     static namespaceIdToString: (namespace?: string | undefined) => string;
     static namespaceStringToId: (namespace: string) => string | undefined;
diff --git a/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker b/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker
index 644dc32dd81409..e2d81c5ae17520 100755
--- a/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker
+++ b/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker
@@ -191,6 +191,7 @@ kibana_vars=(
     telemetry.enabled
     telemetry.optIn
     telemetry.optInStatusUrl
+    telemetry.sendUsageTo
     telemetry.sendUsageFrom
     tilemap.options.attribution
     tilemap.options.maxZoom
diff --git a/src/dev/typescript/build_ts_refs_cli.ts b/src/dev/typescript/build_ts_refs_cli.ts
index 00f298887ee17f..ad7807eb87c66d 100644
--- a/src/dev/typescript/build_ts_refs_cli.ts
+++ b/src/dev/typescript/build_ts_refs_cli.ts
@@ -41,7 +41,7 @@ export async function runBuildRefsCli() {
       const cacheEnabled = process.env.BUILD_TS_REFS_CACHE_ENABLE !== 'false' && !!flags.cache;
       const doCapture = process.env.BUILD_TS_REFS_CACHE_CAPTURE === 'true';
       const doClean = !!flags.clean || doCapture;
-      const doInitCache = cacheEnabled && !doClean;
+      const doInitCache = cacheEnabled && !doCapture;
 
       if (doClean) {
         log.info('deleting', outDirs.length, 'ts output directories');
diff --git a/src/plugins/charts/public/index.ts b/src/plugins/charts/public/index.ts
index cc1a54c2e25b09..0eec6f14eff649 100644
--- a/src/plugins/charts/public/index.ts
+++ b/src/plugins/charts/public/index.ts
@@ -15,6 +15,8 @@ export { ChartsPluginSetup, ChartsPluginStart } from './plugin';
 export * from './static';
 export * from './services/palettes/types';
 export { lightenColor } from './services/palettes/lighten_color';
+export { useActiveCursor } from './services/active_cursor';
+
 export {
   PaletteOutput,
   CustomPaletteArguments,
diff --git a/src/plugins/charts/public/mocks.ts b/src/plugins/charts/public/mocks.ts
index c85a91a1ef5636..7460962c3e1fa6 100644
--- a/src/plugins/charts/public/mocks.ts
+++ b/src/plugins/charts/public/mocks.ts
@@ -8,6 +8,7 @@
 
 import { ChartsPlugin } from './plugin';
 import { themeServiceMock } from './services/theme/mock';
+import { activeCursorMock } from './services/active_cursor/mock';
 import { colorsServiceMock } from './services/legacy_colors/mock';
 import { getPaletteRegistry, paletteServiceMock } from './services/palettes/mock';
 
@@ -23,6 +24,7 @@ const createSetupContract = (): Setup => ({
 const createStartContract = (): Start => ({
   legacyColors: colorsServiceMock,
   theme: themeServiceMock,
+  activeCursor: activeCursorMock,
   palettes: paletteServiceMock.setup({} as any),
 });
 
diff --git a/src/plugins/charts/public/plugin.ts b/src/plugins/charts/public/plugin.ts
index 5bc0b8c84560f4..7802cef3b4934b 100644
--- a/src/plugins/charts/public/plugin.ts
+++ b/src/plugins/charts/public/plugin.ts
@@ -12,6 +12,7 @@ import { palette, systemPalette } from '../common';
 
 import { ThemeService, LegacyColorsService } from './services';
 import { PaletteService } from './services/palettes/service';
+import { ActiveCursor } from './services/active_cursor';
 
 export type Theme = Omit<ThemeService, 'init'>;
 export type Color = Omit<LegacyColorsService, 'init'>;
@@ -28,13 +29,16 @@ export interface ChartsPluginSetup {
 }
 
 /** @public */
-export type ChartsPluginStart = ChartsPluginSetup;
+export type ChartsPluginStart = ChartsPluginSetup & {
+  activeCursor: ActiveCursor;
+};
 
 /** @public */
 export class ChartsPlugin implements Plugin<ChartsPluginSetup, ChartsPluginStart> {
   private readonly themeService = new ThemeService();
   private readonly legacyColorsService = new LegacyColorsService();
   private readonly paletteService = new PaletteService();
+  private readonly activeCursor = new ActiveCursor();
 
   private palettes: undefined | ReturnType<PaletteService['setup']>;
 
@@ -45,6 +49,8 @@ export class ChartsPlugin implements Plugin<ChartsPluginSetup, ChartsPluginStart
     this.legacyColorsService.init(core.uiSettings);
     this.palettes = this.paletteService.setup(this.legacyColorsService);
 
+    this.activeCursor.setup();
+
     return {
       legacyColors: this.legacyColorsService,
       theme: this.themeService,
@@ -57,6 +63,7 @@ export class ChartsPlugin implements Plugin<ChartsPluginSetup, ChartsPluginStart
       legacyColors: this.legacyColorsService,
       theme: this.themeService,
       palettes: this.palettes!,
+      activeCursor: this.activeCursor,
     };
   }
 }
diff --git a/src/plugins/charts/public/services/active_cursor/active_cursor.test.ts b/src/plugins/charts/public/services/active_cursor/active_cursor.test.ts
new file mode 100644
index 00000000000000..7f840c858d603d
--- /dev/null
+++ b/src/plugins/charts/public/services/active_cursor/active_cursor.test.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { ActiveCursor } from './active_cursor';
+
+describe('ActiveCursor', () => {
+  let activeCursor: ActiveCursor;
+
+  beforeEach(() => {
+    activeCursor = new ActiveCursor();
+  });
+
+  test('should initialize activeCursor$ stream on setup hook', () => {
+    expect(activeCursor.activeCursor$).toBeUndefined();
+
+    activeCursor.setup();
+
+    expect(activeCursor.activeCursor$).toMatchInlineSnapshot(`
+      Subject {
+        "_isScalar": false,
+        "closed": false,
+        "hasError": false,
+        "isStopped": false,
+        "observers": Array [],
+        "thrownError": null,
+      }
+    `);
+  });
+});
diff --git a/src/plugins/vis_type_timelion/public/helpers/active_cursor.ts b/src/plugins/charts/public/services/active_cursor/active_cursor.ts
similarity index 66%
rename from src/plugins/vis_type_timelion/public/helpers/active_cursor.ts
rename to src/plugins/charts/public/services/active_cursor/active_cursor.ts
index 7f7f62fd6a9dab..60aefc29169bc2 100644
--- a/src/plugins/vis_type_timelion/public/helpers/active_cursor.ts
+++ b/src/plugins/charts/public/services/active_cursor/active_cursor.ts
@@ -7,6 +7,12 @@
  */
 
 import { Subject } from 'rxjs';
-import { PointerEvent } from '@elastic/charts';
+import type { ActiveCursorPayload } from './types';
 
-export const activeCursor$ = new Subject<PointerEvent>();
+export class ActiveCursor {
+  public activeCursor$?: Subject<ActiveCursorPayload>;
+
+  setup() {
+    this.activeCursor$ = new Subject();
+  }
+}
diff --git a/src/plugins/charts/public/services/active_cursor/active_cursor_utils.test.ts b/src/plugins/charts/public/services/active_cursor/active_cursor_utils.test.ts
new file mode 100644
index 00000000000000..3230c1ec0f32b5
--- /dev/null
+++ b/src/plugins/charts/public/services/active_cursor/active_cursor_utils.test.ts
@@ -0,0 +1,141 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { parseSyncOptions } from './active_cursor_utils';
+import type { Datatable } from '../../../../expressions/public';
+
+describe('active_cursor_utils', () => {
+  describe('parseSyncOptions', () => {
+    describe('dateHistogramSyncOption', () => {
+      test('should return isDateHistogram true in case if that mode is active', () => {
+        expect(parseSyncOptions({ isDateHistogram: true })).toMatchInlineSnapshot(`
+          Object {
+            "isDateHistogram": true,
+          }
+        `);
+      });
+
+      test('should return isDateHistogram false for other cases', () => {
+        expect(parseSyncOptions({ datatables: [] as Datatable[] })).toMatchInlineSnapshot(`
+          Object {
+            "accessors": Array [],
+            "isDateHistogram": false,
+          }
+        `);
+      });
+    });
+
+    describe('datatablesSyncOption', () => {
+      test('should extract accessors', () => {
+        expect(
+          parseSyncOptions({
+            datatables: ([
+              {
+                columns: [
+                  {
+                    meta: {
+                      index: 'foo_index',
+                      field: 'foo_field',
+                    },
+                  },
+                ],
+              },
+            ] as unknown) as Datatable[],
+          }).accessors
+        ).toMatchInlineSnapshot(`
+          Array [
+            "foo_index:foo_field",
+          ]
+        `);
+      });
+
+      test('should return isDateHistogram true in case all datatables is time based', () => {
+        expect(
+          parseSyncOptions({
+            datatables: ([
+              {
+                columns: [
+                  {
+                    meta: {
+                      index: 'foo_index',
+                      field: 'foo_field',
+                      sourceParams: {
+                        appliedTimeRange: {},
+                      },
+                    },
+                  },
+                ],
+              },
+              {
+                columns: [
+                  {
+                    meta: {
+                      index: 'foo_index1',
+                      field: 'foo_field1',
+                      sourceParams: {
+                        appliedTimeRange: {},
+                      },
+                    },
+                  },
+                ],
+              },
+            ] as unknown) as Datatable[],
+          })
+        ).toMatchInlineSnapshot(`
+          Object {
+            "accessors": Array [
+              "foo_index:foo_field",
+              "foo_index1:foo_field1",
+            ],
+            "isDateHistogram": true,
+          }
+        `);
+      });
+
+      test('should return isDateHistogram false in case of not all datatables is time based', () => {
+        expect(
+          parseSyncOptions({
+            datatables: ([
+              {
+                columns: [
+                  {
+                    meta: {
+                      index: 'foo_index',
+                      field: 'foo_field',
+                      sourceParams: {
+                        appliedTimeRange: {},
+                      },
+                    },
+                  },
+                ],
+              },
+              {
+                columns: [
+                  {
+                    meta: {
+                      index: 'foo_index1',
+                      field: 'foo_field1',
+                    },
+                  },
+                ],
+              },
+            ] as unknown) as Datatable[],
+          })
+        ).toMatchInlineSnapshot(`
+          Object {
+            "accessors": Array [
+              "foo_index:foo_field",
+              "foo_index1:foo_field1",
+            ],
+            "isDateHistogram": false,
+          }
+        `);
+      });
+    });
+  });
+});
diff --git a/src/plugins/charts/public/services/active_cursor/active_cursor_utils.ts b/src/plugins/charts/public/services/active_cursor/active_cursor_utils.ts
new file mode 100644
index 00000000000000..37eeb6bf2d8207
--- /dev/null
+++ b/src/plugins/charts/public/services/active_cursor/active_cursor_utils.ts
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import { uniq } from 'lodash';
+
+import type { Datatable } from '../../../../expressions/public';
+import type { ActiveCursorSyncOption, DateHistogramSyncOption } from './types';
+import type { ActiveCursorPayload } from './types';
+
+function isDateHistogramSyncOption(
+  syncOption?: ActiveCursorSyncOption
+): syncOption is DateHistogramSyncOption {
+  return Boolean(syncOption && 'isDateHistogram' in syncOption);
+}
+
+const parseDatatable = (dataTables: Datatable[]) => {
+  const isDateHistogram =
+    Boolean(dataTables.length) &&
+    dataTables.every((dataTable) =>
+      dataTable.columns.some((c) => Boolean(c.meta.sourceParams?.appliedTimeRange))
+    );
+
+  const accessors = uniq(
+    dataTables
+      .map((dataTable) => {
+        const column = dataTable.columns.find((c) => c.meta.index && c.meta.field);
+
+        if (column?.meta.index) {
+          return `${column.meta.index}:${column.meta.field}`;
+        }
+      })
+      .filter(Boolean) as string[]
+  );
+  return { isDateHistogram, accessors };
+};
+
+/** @internal **/
+export const parseSyncOptions = (
+  syncOptions: ActiveCursorSyncOption
+): Partial<ActiveCursorPayload> =>
+  isDateHistogramSyncOption(syncOptions)
+    ? {
+        isDateHistogram: syncOptions.isDateHistogram,
+      }
+    : parseDatatable(syncOptions.datatables);
diff --git a/src/plugins/data/server/field_formats/index.ts b/src/plugins/charts/public/services/active_cursor/index.ts
similarity index 77%
rename from src/plugins/data/server/field_formats/index.ts
rename to src/plugins/charts/public/services/active_cursor/index.ts
index a8e6d28f2c6427..7c1fa88354a7cc 100644
--- a/src/plugins/data/server/field_formats/index.ts
+++ b/src/plugins/charts/public/services/active_cursor/index.ts
@@ -6,4 +6,5 @@
  * Side Public License, v 1.
  */
 
-export { FieldFormatsService, FieldFormatsSetup, FieldFormatsStart } from './field_formats_service';
+export { ActiveCursor } from './active_cursor';
+export { useActiveCursor } from './use_active_cursor';
diff --git a/src/plugins/charts/public/services/active_cursor/mock.ts b/src/plugins/charts/public/services/active_cursor/mock.ts
new file mode 100644
index 00000000000000..118575b9b96fde
--- /dev/null
+++ b/src/plugins/charts/public/services/active_cursor/mock.ts
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { ActiveCursor } from './active_cursor';
+
+export const activeCursorMock: ActiveCursor = {
+  activeCursor$: {
+    subscribe: jest.fn(),
+    pipe: jest.fn(() => ({
+      subscribe: jest.fn(),
+    })),
+  },
+  setup: jest.fn(),
+} as any;
diff --git a/src/plugins/charts/public/services/active_cursor/types.ts b/src/plugins/charts/public/services/active_cursor/types.ts
new file mode 100644
index 00000000000000..0b0180a622efbf
--- /dev/null
+++ b/src/plugins/charts/public/services/active_cursor/types.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { PointerEvent } from '@elastic/charts';
+import type { Datatable } from '../../../../expressions/public';
+
+/** @public **/
+export type ActiveCursorSyncOption = DateHistogramSyncOption | DatatablesSyncOption;
+
+/** @internal **/
+export interface ActiveCursorPayload {
+  cursor: PointerEvent;
+  isDateHistogram?: boolean;
+  accessors?: string[];
+}
+
+/** @internal **/
+interface BaseSyncOptions {
+  debounce?: number;
+}
+
+/** @internal **/
+export interface DateHistogramSyncOption extends BaseSyncOptions {
+  isDateHistogram: boolean;
+}
+
+/** @internal **/
+export interface DatatablesSyncOption extends BaseSyncOptions {
+  datatables: Datatable[];
+}
diff --git a/src/plugins/charts/public/services/active_cursor/use_active_cursor.test.ts b/src/plugins/charts/public/services/active_cursor/use_active_cursor.test.ts
new file mode 100644
index 00000000000000..efe5c9b49849f0
--- /dev/null
+++ b/src/plugins/charts/public/services/active_cursor/use_active_cursor.test.ts
@@ -0,0 +1,183 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import { renderHook } from '@testing-library/react-hooks';
+import type { RefObject } from 'react';
+
+import { ActiveCursor } from './active_cursor';
+import { useActiveCursor } from './use_active_cursor';
+
+import type { ActiveCursorSyncOption, ActiveCursorPayload } from './types';
+import type { Chart, PointerEvent } from '@elastic/charts';
+import type { Datatable } from '../../../../expressions/public';
+
+describe('useActiveCursor', () => {
+  let cursor: ActiveCursorPayload['cursor'];
+  let dispatchExternalPointerEvent: jest.Mock;
+
+  const act = (
+    syncOption: ActiveCursorSyncOption,
+    events: Array<Partial<ActiveCursorPayload>>,
+    eventsTimeout = 1
+  ) =>
+    new Promise(async (resolve) => {
+      const activeCursor = new ActiveCursor();
+      let allEventsExecuted = false;
+
+      activeCursor.setup();
+
+      dispatchExternalPointerEvent.mockImplementation((pointerEvent) => {
+        if (allEventsExecuted) {
+          resolve(pointerEvent);
+        }
+      });
+
+      renderHook(() =>
+        useActiveCursor(
+          activeCursor,
+          {
+            current: {
+              dispatchExternalPointerEvent: dispatchExternalPointerEvent as (
+                pointerEvent: PointerEvent
+              ) => void,
+            },
+          } as RefObject<Chart>,
+          { ...syncOption, debounce: syncOption.debounce ?? 1 }
+        )
+      );
+
+      for (const e of events) {
+        await new Promise((eventResolve) =>
+          setTimeout(() => {
+            if (e === events[events.length - 1]) {
+              allEventsExecuted = true;
+            }
+            activeCursor.activeCursor$!.next({ cursor, ...e });
+            eventResolve(null);
+          }, eventsTimeout)
+        );
+      }
+    });
+
+  beforeEach(() => {
+    cursor = {} as ActiveCursorPayload['cursor'];
+    dispatchExternalPointerEvent = jest.fn();
+  });
+
+  test('should debounce events', async () => {
+    await act(
+      {
+        debounce: 5,
+        datatables: [
+          {
+            columns: [
+              {
+                meta: {
+                  index: 'foo_index',
+                  field: 'foo_field',
+                },
+              },
+            ],
+          },
+        ] as Datatable[],
+      },
+      [
+        { accessors: ['foo_index:foo_field'] },
+        { accessors: ['foo_index:foo_field'] },
+        { accessors: ['foo_index:foo_field'] },
+        { accessors: ['foo_index:foo_field'] },
+      ]
+    );
+
+    expect(dispatchExternalPointerEvent).toHaveBeenCalledTimes(1);
+  });
+
+  test('should trigger cursor pointer update (chart type: time, event type: time)', async () => {
+    await act({ isDateHistogram: true }, [{ isDateHistogram: true }]);
+
+    expect(dispatchExternalPointerEvent).toHaveBeenCalledTimes(1);
+  });
+
+  test('should trigger cursor pointer update (chart type: datatable - time based, event type: time)', async () => {
+    await act(
+      {
+        datatables: ([
+          {
+            columns: [
+              {
+                meta: {
+                  index: 'foo_index',
+                  field: 'foo_field',
+                  sourceParams: {
+                    appliedTimeRange: {},
+                  },
+                },
+              },
+            ],
+          },
+        ] as unknown) as Datatable[],
+      },
+      [{ isDateHistogram: true }, { accessors: ['foo_index:foo_field'] }]
+    );
+
+    expect(dispatchExternalPointerEvent).toHaveBeenCalledTimes(2);
+  });
+
+  test('should not trigger cursor pointer update (chart type: datatable, event type: time)', async () => {
+    await act(
+      {
+        datatables: [
+          {
+            columns: [
+              {
+                meta: {
+                  index: 'foo_index',
+                  field: 'foo_field',
+                },
+              },
+            ],
+          },
+        ] as Datatable[],
+      },
+      [{ isDateHistogram: true }, { accessors: ['foo_index:foo_field'] }]
+    );
+
+    expect(dispatchExternalPointerEvent).toHaveBeenCalledTimes(1);
+  });
+
+  test('should works with multi datatables (intersection)', async () => {
+    await act(
+      {
+        datatables: [
+          {
+            columns: [
+              {
+                meta: {
+                  index: 'ia',
+                  field: 'fa',
+                },
+              },
+            ],
+          },
+          {
+            columns: [
+              {
+                meta: {
+                  index: 'ib',
+                  field: 'fb',
+                },
+              },
+            ],
+          },
+        ] as Datatable[],
+      },
+      [{ accessors: ['foo_index:foo_field', 'ib:fb'] }]
+    );
+
+    expect(dispatchExternalPointerEvent).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/src/plugins/charts/public/services/active_cursor/use_active_cursor.ts b/src/plugins/charts/public/services/active_cursor/use_active_cursor.ts
new file mode 100644
index 00000000000000..b857208e657aee
--- /dev/null
+++ b/src/plugins/charts/public/services/active_cursor/use_active_cursor.ts
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { intersection } from 'lodash';
+import { animationFrameScheduler } from 'rxjs';
+import { useCallback, useEffect, RefObject } from 'react';
+import { filter, debounceTime } from 'rxjs/operators';
+
+import type { Chart } from '@elastic/charts';
+
+import { parseSyncOptions } from './active_cursor_utils';
+
+import type { ActiveCursor } from './active_cursor';
+import type { ActiveCursorSyncOption } from './types';
+
+const DEFAULT_DEBOUNCE_TIME = 40;
+
+export const useActiveCursor = (
+  activeCursor: ActiveCursor,
+  chartRef: RefObject<Chart>,
+  syncOptions: ActiveCursorSyncOption
+) => {
+  const { accessors, isDateHistogram } = parseSyncOptions(syncOptions);
+  const handleCursorUpdate = useCallback(
+    (cursor) => {
+      activeCursor.activeCursor$?.next({
+        cursor,
+        isDateHistogram,
+        accessors,
+      });
+    },
+    [activeCursor.activeCursor$, accessors, isDateHistogram]
+  );
+
+  useEffect(() => {
+    const cursorSubscription = activeCursor.activeCursor$
+      ?.pipe(
+        debounceTime(syncOptions.debounce ?? DEFAULT_DEBOUNCE_TIME, animationFrameScheduler),
+        filter((payload) => {
+          if (payload.isDateHistogram && isDateHistogram) {
+            return true;
+          }
+          return intersection(accessors, payload.accessors).length > 0;
+        })
+      )
+      .subscribe(({ cursor }) => {
+        chartRef?.current?.dispatchExternalPointerEvent(cursor);
+      });
+
+    return () => {
+      cursorSubscription?.unsubscribe();
+    };
+  }, [activeCursor.activeCursor$, syncOptions.debounce, chartRef, accessors, isDateHistogram]);
+
+  return handleCursorUpdate;
+};
diff --git a/src/plugins/charts/public/services/index.ts b/src/plugins/charts/public/services/index.ts
index aa2326f47377f9..88d92543cb8dd6 100644
--- a/src/plugins/charts/public/services/index.ts
+++ b/src/plugins/charts/public/services/index.ts
@@ -8,3 +8,4 @@
 
 export { LegacyColorsService } from './legacy_colors';
 export { ThemeService } from './theme';
+export { ActiveCursor, useActiveCursor } from './active_cursor';
diff --git a/src/plugins/dashboard/public/application/actions/export_csv_action.tsx b/src/plugins/dashboard/public/application/actions/export_csv_action.tsx
index dd6eeb92ef932d..cf643fa7d271fc 100644
--- a/src/plugins/dashboard/public/application/actions/export_csv_action.tsx
+++ b/src/plugins/dashboard/public/application/actions/export_csv_action.tsx
@@ -8,7 +8,7 @@
 
 import { Datatable } from 'src/plugins/expressions/public';
 import { CoreStart } from '../../../../../core/public';
-import { FormatFactory } from '../../../../data/common/field_formats/utils';
+import { FormatFactory } from '../../../../field_formats/common';
 
 import { DataPublicPluginStart, exporters } from '../../services/data';
 import { downloadMultipleAs } from '../../services/share';
diff --git a/src/plugins/dashboard/public/application/embeddable/empty_screen/__snapshots__/dashboard_empty_screen.test.tsx.snap b/src/plugins/dashboard/public/application/embeddable/empty_screen/__snapshots__/dashboard_empty_screen.test.tsx.snap
index afe339f3f43a23..70a21438754bd3 100644
--- a/src/plugins/dashboard/public/application/embeddable/empty_screen/__snapshots__/dashboard_empty_screen.test.tsx.snap
+++ b/src/plugins/dashboard/public/application/embeddable/empty_screen/__snapshots__/dashboard_empty_screen.test.tsx.snap
@@ -308,6 +308,7 @@ exports[`DashboardEmptyScreen renders correctly with edit mode 1`] = `
               >
                 <div
                   className="euiTextColor euiTextColor--subdued"
+                  style={Object {}}
                 >
                   <span>
                     Create content that tells a story about your data.
@@ -666,6 +667,7 @@ exports[`DashboardEmptyScreen renders correctly with readonly mode 1`] = `
                           >
                             <div
                               className="euiTextColor euiTextColor--subdued"
+                              style={Object {}}
                             >
                               You need additional privileges to edit this dashboard.
                             </div>
@@ -1023,6 +1025,7 @@ exports[`DashboardEmptyScreen renders correctly with view mode 1`] = `
                             >
                               <div
                                 className="euiTextColor euiTextColor--subdued"
+                                style={Object {}}
                               >
                                 <p>
                                   Click edit in the menu bar above to start adding panels.
diff --git a/src/plugins/data/README.mdx b/src/plugins/data/README.mdx
index fba5cbd6d48e17..c2da9a686cacbf 100644
--- a/src/plugins/data/README.mdx
+++ b/src/plugins/data/README.mdx
@@ -49,10 +49,6 @@ This is helpful when you want to provide a user with options, for example when c
 
 ```
 
-## Field Formats
-
-Coming soon.
-
 ## Index Patterns
 
 The Index Patterns API provides a consistent method of structuring and formatting documents
diff --git a/src/plugins/data/common/constants.ts b/src/plugins/data/common/constants.ts
index 89ccdfcc0479e7..406da4e56d1503 100644
--- a/src/plugins/data/common/constants.ts
+++ b/src/plugins/data/common/constants.ts
@@ -31,13 +31,6 @@ export const UI_SETTINGS = {
   HISTOGRAM_BAR_TARGET: 'histogram:barTarget',
   HISTOGRAM_MAX_BARS: 'histogram:maxBars',
   HISTORY_LIMIT: 'history:limit',
-  SHORT_DOTS_ENABLE: 'shortDots:enable',
-  FORMAT_DEFAULT_TYPE_MAP: 'format:defaultTypeMap',
-  FORMAT_NUMBER_DEFAULT_PATTERN: 'format:number:defaultPattern',
-  FORMAT_PERCENT_DEFAULT_PATTERN: 'format:percent:defaultPattern',
-  FORMAT_BYTES_DEFAULT_PATTERN: 'format:bytes:defaultPattern',
-  FORMAT_CURRENCY_DEFAULT_PATTERN: 'format:currency:defaultPattern',
-  FORMAT_NUMBER_DEFAULT_LOCALE: 'format:number:defaultLocale',
   TIMEPICKER_REFRESH_INTERVAL_DEFAULTS: 'timepicker:refreshIntervalDefaults',
   TIMEPICKER_QUICK_RANGES: 'timepicker:quickRanges',
   TIMEPICKER_TIME_DEFAULTS: 'timepicker:timeDefaults',
diff --git a/src/plugins/data/common/exports/export_csv.test.ts b/src/plugins/data/common/exports/export_csv.test.ts
index 8bf44fe48a5890..f108e69c68d568 100644
--- a/src/plugins/data/common/exports/export_csv.test.ts
+++ b/src/plugins/data/common/exports/export_csv.test.ts
@@ -7,7 +7,7 @@
  */
 
 import { Datatable } from 'src/plugins/expressions';
-import { FieldFormat } from '../../common/field_formats';
+import { FieldFormat } from '../../../field_formats/common';
 import { datatableToCSV } from './export_csv';
 
 function getDefaultOptions() {
diff --git a/src/plugins/data/common/exports/export_csv.tsx b/src/plugins/data/common/exports/export_csv.tsx
index d4477e72b64c41..68f817d1b1484a 100644
--- a/src/plugins/data/common/exports/export_csv.tsx
+++ b/src/plugins/data/common/exports/export_csv.tsx
@@ -8,8 +8,8 @@
 
 // Inspired by the inspector CSV exporter
 
-import { FormatFactory } from 'src/plugins/data/common/field_formats/utils';
 import { Datatable } from 'src/plugins/expressions';
+import { FormatFactory } from '../../../field_formats/common';
 import { createEscapeValue } from './escape_value';
 
 export const LINE_FEED_CHARACTER = '\r\n';
diff --git a/src/plugins/data/common/index.ts b/src/plugins/data/common/index.ts
index cd05c613f793f6..2bc383db6f5304 100644
--- a/src/plugins/data/common/index.ts
+++ b/src/plugins/data/common/index.ts
@@ -8,7 +8,6 @@
 
 export * from './constants';
 export * from './es_query';
-export * from './field_formats';
 export * from './index_patterns';
 export * from './kbn_field_types';
 export * from './query';
diff --git a/src/plugins/data/common/index_patterns/fields/index_pattern_field.test.ts b/src/plugins/data/common/index_patterns/fields/index_pattern_field.test.ts
index 73f015ca5517c3..f95de90955b654 100644
--- a/src/plugins/data/common/index_patterns/fields/index_pattern_field.test.ts
+++ b/src/plugins/data/common/index_patterns/fields/index_pattern_field.test.ts
@@ -8,8 +8,9 @@
 
 import { IndexPatternField } from './index_pattern_field';
 import { IndexPattern } from '../index_patterns';
-import { KBN_FIELD_TYPES, FieldFormat } from '../../../common';
+import { KBN_FIELD_TYPES } from '../../../common';
 import { FieldSpec, RuntimeField } from '../types';
+import { FieldFormat } from '../../../../field_formats/common';
 
 describe('Field', function () {
   function flatten(obj: Record<string, any>) {
diff --git a/src/plugins/data/common/index_patterns/index.ts b/src/plugins/data/common/index_patterns/index.ts
index 7f6249caceb52e..340162e8bda70e 100644
--- a/src/plugins/data/common/index_patterns/index.ts
+++ b/src/plugins/data/common/index_patterns/index.ts
@@ -6,10 +6,10 @@
  * Side Public License, v 1.
  */
 
+export * from './constants';
 export * from './fields';
 export * from './types';
 export { IndexPatternsService, IndexPatternsContract } from './index_patterns';
 export type { IndexPattern } from './index_patterns';
 export * from './errors';
 export * from './expressions';
-export * from './constants';
diff --git a/src/plugins/data/common/index_patterns/index_patterns/flatten_hit.test.ts b/src/plugins/data/common/index_patterns/index_patterns/flatten_hit.test.ts
index 9a33b0cfa6f1ce..f4f94856c7226a 100644
--- a/src/plugins/data/common/index_patterns/index_patterns/flatten_hit.test.ts
+++ b/src/plugins/data/common/index_patterns/index_patterns/flatten_hit.test.ts
@@ -12,7 +12,7 @@ import { IndexPattern } from './index_pattern';
 import mockLogStashFields from './fixtures/logstash_fields';
 import { stubbedSavedObjectIndexPattern } from './fixtures/stubbed_saved_object_index_pattern';
 
-import { fieldFormatsMock } from '../../field_formats/mocks';
+import { fieldFormatsMock } from '../../../../field_formats/common/mocks';
 import { flattenHitWrapper } from './flatten_hit';
 
 class MockFieldFormatter {}
diff --git a/src/plugins/data/common/index_patterns/index_patterns/format_hit.ts b/src/plugins/data/common/index_patterns/index_patterns/format_hit.ts
index 732b9c7c8eab0b..fe872ae9298999 100644
--- a/src/plugins/data/common/index_patterns/index_patterns/format_hit.ts
+++ b/src/plugins/data/common/index_patterns/index_patterns/format_hit.ts
@@ -8,7 +8,7 @@
 
 import _ from 'lodash';
 import { IndexPattern } from './index_pattern';
-import { FieldFormatsContentType } from '../../../common';
+import { FieldFormatsContentType } from '../../../../field_formats/common';
 
 const formattedCache = new WeakMap();
 const partialFormattedCache = new WeakMap();
diff --git a/src/plugins/data/common/index_patterns/index_patterns/index_pattern.test.ts b/src/plugins/data/common/index_patterns/index_patterns/index_pattern.test.ts
index 508bddb7a4096f..7c111f7666544a 100644
--- a/src/plugins/data/common/index_patterns/index_patterns/index_pattern.test.ts
+++ b/src/plugins/data/common/index_patterns/index_patterns/index_pattern.test.ts
@@ -16,8 +16,8 @@ import mockLogStashFields from './fixtures/logstash_fields';
 import { stubbedSavedObjectIndexPattern } from './fixtures/stubbed_saved_object_index_pattern';
 import { IndexPatternField } from '../fields';
 
-import { fieldFormatsMock } from '../../field_formats/mocks';
-import { FieldFormat } from '../..';
+import { fieldFormatsMock } from '../../../../field_formats/common/mocks';
+import { FieldFormat } from '../../../../field_formats/common';
 import { RuntimeField } from '../types';
 
 class MockFieldFormatter {}
diff --git a/src/plugins/data/common/index_patterns/index_patterns/index_pattern.ts b/src/plugins/data/common/index_patterns/index_patterns/index_pattern.ts
index b3f2605723c02a..48bcdf6982b672 100644
--- a/src/plugins/data/common/index_patterns/index_patterns/index_pattern.ts
+++ b/src/plugins/data/common/index_patterns/index_patterns/index_pattern.ts
@@ -15,7 +15,7 @@ import { ES_FIELD_TYPES, KBN_FIELD_TYPES, IIndexPattern, IFieldType } from '../.
 import { IndexPatternField, IIndexPatternFieldList, fieldList } from '../fields';
 import { formatHitProvider } from './format_hit';
 import { flattenHitWrapper } from './flatten_hit';
-import { FieldFormatsStartCommon, FieldFormat } from '../../field_formats';
+import { FieldFormatsStartCommon, FieldFormat } from '../../../../field_formats/common';
 import { IndexPatternSpec, TypeMeta, SourceFilter, IndexPatternFieldMap } from '../types';
 import { SerializedFieldFormat } from '../../../../expressions/common';
 import { castEsToKbnFieldTypeName } from '../../kbn_field_types';
diff --git a/src/plugins/data/common/index_patterns/index_patterns/index_patterns.test.ts b/src/plugins/data/common/index_patterns/index_patterns/index_patterns.test.ts
index 8715f8feb067a0..a80e97b4e2caba 100644
--- a/src/plugins/data/common/index_patterns/index_patterns/index_patterns.test.ts
+++ b/src/plugins/data/common/index_patterns/index_patterns/index_patterns.test.ts
@@ -8,7 +8,7 @@
 
 import { defaults } from 'lodash';
 import { IndexPatternsService, IndexPattern } from '.';
-import { fieldFormatsMock } from '../../field_formats/mocks';
+import { fieldFormatsMock } from '../../../../field_formats/common/mocks';
 import { stubbedSavedObjectIndexPattern } from './fixtures/stubbed_saved_object_index_pattern';
 import { UiSettingsCommon, SavedObjectsClientCommon, SavedObject } from '../types';
 
diff --git a/src/plugins/data/common/index_patterns/index_patterns/index_patterns.ts b/src/plugins/data/common/index_patterns/index_patterns/index_patterns.ts
index cecf3b8c07d1ac..64628f7165f275 100644
--- a/src/plugins/data/common/index_patterns/index_patterns/index_patterns.ts
+++ b/src/plugins/data/common/index_patterns/index_patterns/index_patterns.ts
@@ -29,7 +29,7 @@ import {
   FieldSpec,
   IndexPatternFieldMap,
 } from '../types';
-import { FieldFormatsStartCommon } from '../../field_formats';
+import { FieldFormatsStartCommon, FORMATS_UI_SETTINGS } from '../../../../field_formats/common/';
 import { UI_SETTINGS, SavedObject } from '../../../common';
 import { SavedObjectNotFound } from '../../../../kibana_utils/common';
 import { IndexPatternMissingIndices } from '../lib';
@@ -500,7 +500,7 @@ export class IndexPatternsService {
    * @returns IndexPattern
    */
   async create(spec: IndexPatternSpec, skipFetchFields = false): Promise<IndexPattern> {
-    const shortDotsEnable = await this.config.get(UI_SETTINGS.SHORT_DOTS_ENABLE);
+    const shortDotsEnable = await this.config.get(FORMATS_UI_SETTINGS.SHORT_DOTS_ENABLE);
     const metaFields = await this.config.get(UI_SETTINGS.META_FIELDS);
 
     const indexPattern = new IndexPattern({
@@ -528,7 +528,7 @@ export class IndexPatternsService {
     const indexPattern = await this.create(spec, skipFetchFields);
     const createdIndexPattern = await this.createSavedObject(indexPattern, override);
     await this.setDefault(createdIndexPattern.id!);
-    return createdIndexPattern;
+    return createdIndexPattern!;
   }
 
   /**
diff --git a/src/plugins/data/common/index_patterns/types.ts b/src/plugins/data/common/index_patterns/types.ts
index d05a7ea6e2d939..0e088d7aa8a8d4 100644
--- a/src/plugins/data/common/index_patterns/types.ts
+++ b/src/plugins/data/common/index_patterns/types.ts
@@ -13,7 +13,8 @@ import type { SavedObject } from 'src/core/server';
 import { IFieldType } from './fields';
 import { RUNTIME_FIELD_TYPES } from './constants';
 import { SerializedFieldFormat } from '../../../expressions/common';
-import { KBN_FIELD_TYPES, IndexPatternField, FieldFormat } from '..';
+import { KBN_FIELD_TYPES, IndexPatternField } from '..';
+import { FieldFormat } from '../../../field_formats/common';
 
 export type FieldFormatMap = Record<string, SerializedFieldFormat>;
 
@@ -184,6 +185,7 @@ export interface FieldSpecExportFmt {
 }
 
 /**
+ * @public
  * Serialized version of IndexPatternField
  */
 export interface FieldSpec extends IndexPatternFieldBase {
diff --git a/src/plugins/data/common/search/aggs/agg_config.ts b/src/plugins/data/common/search/aggs/agg_config.ts
index 90540dc33cb6f7..f55bfe24cd465d 100644
--- a/src/plugins/data/common/search/aggs/agg_config.ts
+++ b/src/plugins/data/common/search/aggs/agg_config.ts
@@ -30,7 +30,7 @@ export interface SerializableState {
   [key: string]: State | State[];
 }
 
-/** @internal **/
+/** @public **/
 export type AggConfigSerialized = Ensure<
   {
     type: string;
diff --git a/src/plugins/data/common/search/aggs/agg_types.ts b/src/plugins/data/common/search/aggs/agg_types.ts
index 1db60db507f0f4..375de79f7f0813 100644
--- a/src/plugins/data/common/search/aggs/agg_types.ts
+++ b/src/plugins/data/common/search/aggs/agg_types.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { FieldFormatsStartCommon } from '../../field_formats';
+import { FieldFormatsStartCommon } from '../../../../field_formats/common';
 
 import * as buckets from './buckets';
 import * as metrics from './metrics';
diff --git a/src/plugins/data/common/search/aggs/buckets/create_filter/histogram.test.ts b/src/plugins/data/common/search/aggs/buckets/create_filter/histogram.test.ts
index c147708b5b2f94..0cefd6b73b3360 100644
--- a/src/plugins/data/common/search/aggs/buckets/create_filter/histogram.test.ts
+++ b/src/plugins/data/common/search/aggs/buckets/create_filter/histogram.test.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { BytesFormat, FieldFormatsGetConfigFn } from '../../../../../common/field_formats';
+import { BytesFormat, FieldFormatsGetConfigFn } from '../../../../../../field_formats/common';
 import { AggConfigs } from '../../agg_configs';
 import { mockAggTypesRegistry, mockGetFieldFormatsStart } from '../../test_helpers';
 import { BUCKET_TYPES } from '../bucket_agg_types';
diff --git a/src/plugins/data/common/search/aggs/buckets/create_filter/ip_range.test.ts b/src/plugins/data/common/search/aggs/buckets/create_filter/ip_range.test.ts
index 1e4d97a0073012..51ea6d081d1390 100644
--- a/src/plugins/data/common/search/aggs/buckets/create_filter/ip_range.test.ts
+++ b/src/plugins/data/common/search/aggs/buckets/create_filter/ip_range.test.ts
@@ -9,7 +9,7 @@
 import { createFilterIpRange } from './ip_range';
 import { AggConfigs, CreateAggConfigParams } from '../../agg_configs';
 import { mockAggTypesRegistry } from '../../test_helpers';
-import { IpFormat } from '../../../../../common';
+import { IpFormat } from '../../../../../../field_formats/common';
 import { BUCKET_TYPES } from '../bucket_agg_types';
 import { IBucketAggConfig } from '../bucket_agg_type';
 
diff --git a/src/plugins/data/common/search/aggs/buckets/create_filter/range.test.ts b/src/plugins/data/common/search/aggs/buckets/create_filter/range.test.ts
index 7e4289e23cfaee..c9ab1617929dc1 100644
--- a/src/plugins/data/common/search/aggs/buckets/create_filter/range.test.ts
+++ b/src/plugins/data/common/search/aggs/buckets/create_filter/range.test.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { BytesFormat, FieldFormatsGetConfigFn } from '../../../../../common/field_formats';
+import { BytesFormat, FieldFormatsGetConfigFn } from '../../../../../../field_formats/common';
 import { AggConfigs } from '../../agg_configs';
 import { mockAggTypesRegistry, mockGetFieldFormatsStart } from '../../test_helpers';
 import { IBucketAggConfig } from '../bucket_agg_type';
diff --git a/src/plugins/data/common/search/aggs/buckets/range.test.ts b/src/plugins/data/common/search/aggs/buckets/range.test.ts
index 60a58a68e18e0a..202cc59c83c0f6 100644
--- a/src/plugins/data/common/search/aggs/buckets/range.test.ts
+++ b/src/plugins/data/common/search/aggs/buckets/range.test.ts
@@ -9,7 +9,7 @@
 import { AggConfigs } from '../agg_configs';
 import { mockAggTypesRegistry } from '../test_helpers';
 import { BUCKET_TYPES } from './bucket_agg_types';
-import { FieldFormatsGetConfigFn, NumberFormat } from '../../../../common/field_formats';
+import { FieldFormatsGetConfigFn, NumberFormat } from '../../../../../field_formats/common';
 
 describe('Range Agg', () => {
   const getConfig = (() => {}) as FieldFormatsGetConfigFn;
diff --git a/src/plugins/data/common/search/aggs/buckets/shard_delay.test.ts b/src/plugins/data/common/search/aggs/buckets/shard_delay.test.ts
index 51c71cd1a2994a..9f7559c6fe34fc 100644
--- a/src/plugins/data/common/search/aggs/buckets/shard_delay.test.ts
+++ b/src/plugins/data/common/search/aggs/buckets/shard_delay.test.ts
@@ -7,7 +7,7 @@
  */
 
 import { AggConfigs } from '../agg_configs';
-import { FieldFormatsGetConfigFn, NumberFormat } from '../../../../common/field_formats';
+import { FieldFormatsGetConfigFn, NumberFormat } from '../../../../../field_formats/common';
 import { getShardDelayBucketAgg, SHARD_DELAY_AGG_NAME } from './shard_delay';
 
 describe('Shard Delay Agg', () => {
diff --git a/src/plugins/data/common/search/aggs/test_helpers/mock_agg_types_registry.ts b/src/plugins/data/common/search/aggs/test_helpers/mock_agg_types_registry.ts
index ff22af720bde61..50c8966d284a07 100644
--- a/src/plugins/data/common/search/aggs/test_helpers/mock_agg_types_registry.ts
+++ b/src/plugins/data/common/search/aggs/test_helpers/mock_agg_types_registry.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { fieldFormatsMock } from '../../../field_formats/mocks';
+import { fieldFormatsMock } from '../../../../../field_formats/common/mocks';
 
 import { AggTypesRegistry, AggTypesRegistryStart } from '../agg_types_registry';
 import { AggTypesDependencies, getAggTypes } from '../agg_types';
diff --git a/src/plugins/data/common/search/aggs/utils/get_aggs_formats.test.ts b/src/plugins/data/common/search/aggs/utils/get_aggs_formats.test.ts
index 1cf80a6d0085c5..76112980c55fbc 100644
--- a/src/plugins/data/common/search/aggs/utils/get_aggs_formats.test.ts
+++ b/src/plugins/data/common/search/aggs/utils/get_aggs_formats.test.ts
@@ -8,8 +8,11 @@
 
 import { identity } from 'lodash';
 
-import { SerializedFieldFormat } from 'src/plugins/expressions/common/types';
-import { FieldFormat, IFieldFormat } from '../../../../common';
+import {
+  FieldFormat,
+  IFieldFormat,
+  SerializedFieldFormat,
+} from '../../../../../field_formats/common';
 import { getAggsFormats } from './get_aggs_formats';
 
 const getAggFormat = (
diff --git a/src/plugins/data/common/search/aggs/utils/get_aggs_formats.ts b/src/plugins/data/common/search/aggs/utils/get_aggs_formats.ts
index 175b6832b3c854..2aead866c6b60e 100644
--- a/src/plugins/data/common/search/aggs/utils/get_aggs_formats.ts
+++ b/src/plugins/data/common/search/aggs/utils/get_aggs_formats.ts
@@ -15,7 +15,7 @@ import {
   FieldFormatInstanceType,
   FieldFormatsContentType,
   IFieldFormat,
-} from '../../../../common/field_formats';
+} from '../../../../../field_formats/common';
 import { DateRange } from '../../expressions';
 import { convertDateRangeToString } from '../buckets/lib/date_range';
 import { convertIPRangeToString, IpRangeKey } from '../buckets/lib/ip_range';
diff --git a/src/plugins/data/common/search/expressions/esaggs/create_filter.test.ts b/src/plugins/data/common/search/expressions/esaggs/create_filter.test.ts
index b78980cb5136e1..e200f9bf02536b 100644
--- a/src/plugins/data/common/search/expressions/esaggs/create_filter.test.ts
+++ b/src/plugins/data/common/search/expressions/esaggs/create_filter.test.ts
@@ -7,7 +7,7 @@
  */
 
 import { isRangeFilter } from '@kbn/es-query';
-import { BytesFormat, FieldFormatsGetConfigFn } from '../../../field_formats';
+import { BytesFormat, FieldFormatsGetConfigFn } from '../../../../../field_formats/common';
 import { AggConfigs, IAggConfig } from '../../aggs';
 import { mockAggTypesRegistry } from '../../aggs/test_helpers';
 
diff --git a/src/plugins/data/common/search/search_source/search_source.ts b/src/plugins/data/common/search/search_source/search_source.ts
index c982ba1e7a2937..c72976e3412a6c 100644
--- a/src/plugins/data/common/search/search_source/search_source.ts
+++ b/src/plugins/data/common/search/search_source/search_source.ts
@@ -99,7 +99,7 @@ import {
   isPartialResponse,
   IKibanaSearchResponse,
 } from '../../../common';
-import { getHighlightRequest } from '../../../common/field_formats';
+import { getHighlightRequest } from '../../../../field_formats/common';
 import { extractReferences } from './extract_references';
 
 /** @internal */
diff --git a/src/plugins/data/kibana.json b/src/plugins/data/kibana.json
index e425d0701155bd..e6faa6bd0b1a7a 100644
--- a/src/plugins/data/kibana.json
+++ b/src/plugins/data/kibana.json
@@ -3,8 +3,8 @@
   "version": "kibana",
   "server": true,
   "ui": true,
-  "requiredPlugins": ["bfetch", "expressions", "uiActions", "share", "inspector"],
-  "serviceFolders": ["search", "index_patterns", "query", "autocomplete", "ui", "field_formats"],
+  "requiredPlugins": ["bfetch", "expressions", "uiActions", "share", "inspector", "fieldFormats"],
+  "serviceFolders": ["search", "index_patterns", "query", "autocomplete", "ui"],
   "optionalPlugins": ["usageCollection"],
   "extraPublicDirs": ["common"],
   "requiredBundles": ["kibanaUtils", "kibanaReact", "inspector"],
diff --git a/src/plugins/data/public/actions/filters/create_filters_from_range_select.test.ts b/src/plugins/data/public/actions/filters/create_filters_from_range_select.test.ts
index ea7d7690fb876c..5c3b016dc631e7 100644
--- a/src/plugins/data/public/actions/filters/create_filters_from_range_select.test.ts
+++ b/src/plugins/data/public/actions/filters/create_filters_from_range_select.test.ts
@@ -10,14 +10,11 @@ import moment from 'moment';
 
 import { createFiltersFromRangeSelectAction } from './create_filters_from_range_select';
 
-import {
-  fieldFormats,
-  FieldFormatsGetConfigFn,
-  IndexPatternsContract,
-  RangeFilter,
-} from '../../../public';
+import { IndexPatternsContract, RangeFilter } from '../../../public';
 import { dataPluginMock } from '../../../public/mocks';
 import { setIndexPatterns, setSearchService } from '../../../public/services';
+import { FieldFormatsGetConfigFn } from '../../../../field_formats/common';
+import { DateFormat } from '../../../../field_formats/public/';
 
 describe('brushEvent', () => {
   const DAY_IN_MS = 24 * 60 * 60 * 1000;
@@ -35,7 +32,7 @@ describe('brushEvent', () => {
       id: 'logstash-*',
     },
     filterable: true,
-    format: new fieldFormats.DateFormat({}, (() => {}) as FieldFormatsGetConfigFn),
+    format: new DateFormat({}, (() => {}) as FieldFormatsGetConfigFn),
   };
 
   const indexPattern = {
diff --git a/src/plugins/data/public/actions/filters/create_filters_from_value_click.test.ts b/src/plugins/data/public/actions/filters/create_filters_from_value_click.test.ts
index 14ae24a2a5626b..563321cf56fefd 100644
--- a/src/plugins/data/public/actions/filters/create_filters_from_value_click.test.ts
+++ b/src/plugins/data/public/actions/filters/create_filters_from_value_click.test.ts
@@ -6,18 +6,14 @@
  * Side Public License, v 1.
  */
 
-import {
-  fieldFormats,
-  FieldFormatsGetConfigFn,
-  esFilters,
-  IndexPatternsContract,
-} from '../../../public';
+import { esFilters, IndexPatternsContract } from '../../../public';
 import { dataPluginMock } from '../../../public/mocks';
 import { setIndexPatterns, setSearchService } from '../../../public/services';
 import {
   createFiltersFromValueClickAction,
   ValueClickDataContext,
 } from './create_filters_from_value_click';
+import { FieldFormatsGetConfigFn, BytesFormat } from '../../../../field_formats/common';
 
 const mockField = {
   name: 'bytes',
@@ -72,8 +68,7 @@ describe('createFiltersFromValueClick', () => {
           getByName: () => mockField,
           filter: () => [mockField],
         },
-        getFormatterForField: () =>
-          new fieldFormats.BytesFormat({}, (() => {}) as FieldFormatsGetConfigFn),
+        getFormatterForField: () => new BytesFormat({}, (() => {}) as FieldFormatsGetConfigFn),
       }),
     } as unknown) as IndexPatternsContract);
   });
diff --git a/src/plugins/data/public/autocomplete/providers/value_suggestion_provider.ts b/src/plugins/data/public/autocomplete/providers/value_suggestion_provider.ts
index 7bbdae497644ab..0c98d0733c6474 100644
--- a/src/plugins/data/public/autocomplete/providers/value_suggestion_provider.ts
+++ b/src/plugins/data/public/autocomplete/providers/value_suggestion_provider.ts
@@ -7,15 +7,10 @@
  */
 
 import dateMath from '@elastic/datemath';
+import { buildQueryFromFilters } from '@kbn/es-query';
 import { memoize } from 'lodash';
 import { CoreSetup } from 'src/core/public';
-import {
-  IIndexPattern,
-  IFieldType,
-  UI_SETTINGS,
-  buildQueryFromFilters,
-  ValueSuggestionsMethod,
-} from '../../../common';
+import { IIndexPattern, IFieldType, UI_SETTINGS, ValueSuggestionsMethod } from '../../../common';
 import { TimefilterSetup } from '../../query';
 import { AutocompleteUsageCollector } from '../collectors';
 
diff --git a/src/plugins/data/public/field_formats/field_formats_registry.stub.ts b/src/plugins/data/public/field_formats/field_formats_registry.stub.ts
deleted file mode 100644
index 566532085059d2..00000000000000
--- a/src/plugins/data/public/field_formats/field_formats_registry.stub.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { CoreSetup } from 'src/core/public';
-import { baseFormattersPublic } from './constants';
-import { fieldFormats } from '..';
-
-export const getFieldFormatsRegistry = (core: CoreSetup) => {
-  const fieldFormatsRegistry = new fieldFormats.FieldFormatsRegistry();
-  const getConfig = core.uiSettings.get.bind(core.uiSettings);
-
-  fieldFormatsRegistry.init(getConfig, {}, baseFormattersPublic);
-
-  return fieldFormatsRegistry;
-};
diff --git a/src/plugins/data/public/index.scss b/src/plugins/data/public/index.scss
index c0eebf3402771d..467efa98934eca 100644
--- a/src/plugins/data/public/index.scss
+++ b/src/plugins/data/public/index.scss
@@ -1,3 +1,2 @@
 @import './ui/index';
 @import './utils/table_inspector_view/index';
-@import './field_formats/converters/index';
diff --git a/src/plugins/data/public/index.ts b/src/plugins/data/public/index.ts
index e3ecacfbda5ad3..99c89ac69b7951 100644
--- a/src/plugins/data/public/index.ts
+++ b/src/plugins/data/public/index.ts
@@ -19,75 +19,6 @@ export { getEsQueryConfig } from '../common';
 export { FilterLabel, FilterItem } from './ui';
 export { getDisplayValueFromFilter, generateFilters, extractTimeRange } from './query';
 
-/*
- * Field Formatters:
- */
-
-import {
-  FieldFormat,
-  FieldFormatsRegistry,
-  DEFAULT_CONVERTER_COLOR,
-  HTML_CONTEXT_TYPE,
-  TEXT_CONTEXT_TYPE,
-  FIELD_FORMAT_IDS,
-  BoolFormat,
-  BytesFormat,
-  ColorFormat,
-  DurationFormat,
-  IpFormat,
-  NumberFormat,
-  PercentFormat,
-  RelativeDateFormat,
-  SourceFormat,
-  StaticLookupFormat,
-  UrlFormat,
-  StringFormat,
-  TruncateFormat,
-  HistogramFormat,
-} from '../common/field_formats';
-
-import { DateNanosFormat, DateFormat } from './field_formats';
-export { baseFormattersPublic, FieldFormatsStart } from './field_formats';
-
-// Field formats helpers namespace:
-export const fieldFormats = {
-  FieldFormat,
-  FieldFormatsRegistry, // exported only for tests. Consider mock.
-
-  DEFAULT_CONVERTER_COLOR,
-  HTML_CONTEXT_TYPE,
-  TEXT_CONTEXT_TYPE,
-  FIELD_FORMAT_IDS,
-
-  BoolFormat,
-  BytesFormat,
-  ColorFormat,
-  DateFormat,
-  DateNanosFormat,
-  DurationFormat,
-  IpFormat,
-  NumberFormat,
-  PercentFormat,
-  RelativeDateFormat,
-  SourceFormat,
-  StaticLookupFormat,
-  UrlFormat,
-  StringFormat,
-  TruncateFormat,
-  HistogramFormat,
-};
-
-export {
-  IFieldFormat,
-  FieldFormatInstanceType,
-  IFieldFormatsRegistry,
-  FieldFormatsContentType,
-  FieldFormatsGetConfigFn,
-  FieldFormatConfig,
-  FieldFormatId,
-  FieldFormat,
-} from '../common';
-
 /**
  * Exporters (CSV)
  */
@@ -114,7 +45,6 @@ import {
   isDefault,
   validateIndexPattern,
   flattenHitWrapper,
-  formatHitProvider,
 } from './index_patterns';
 
 export type { IndexPatternsService } from './index_patterns';
@@ -130,15 +60,9 @@ export const indexPatterns = {
   isNestedField,
   validate: validateIndexPattern,
   flattenHitWrapper,
-  formatHitProvider,
 };
 
-export {
-  IndexPatternsContract,
-  IndexPattern,
-  IIndexPatternFieldList,
-  IndexPatternField,
-} from './index_patterns';
+export { IndexPatternsContract, IndexPattern, IndexPatternField } from './index_patterns';
 
 export {
   IIndexPattern,
@@ -147,12 +71,13 @@ export {
   KBN_FIELD_TYPES,
   IndexPatternAttributes,
   UI_SETTINGS,
-  TypeMeta as IndexPatternTypeMeta,
   AggregationRestrictions as IndexPatternAggRestrictions,
   IndexPatternSpec,
   IndexPatternLoadExpressionFunctionDefinition,
   fieldList,
+  GetFieldsOptions,
   INDEX_PATTERN_SAVED_OBJECT_TYPE,
+  AggregationRestrictions,
   IndexPatternType,
 } from '../common';
 
@@ -249,19 +174,10 @@ export type {
   ISearchStartSearchSource,
   ISearchGeneric,
   ISearchSource,
-  SearchInterceptor,
-  SearchInterceptorDeps,
   SearchRequest,
   SearchSourceFields,
-  // expression functions and types
-  EsdslExpressionFunctionDefinition,
-  EsRawResponseExpressionTypeDefinition,
   // errors
   IEsError,
-  SearchError,
-  SearchTimeoutError,
-  TimeoutErrorMode,
-  PainlessError,
   Reason,
   WaitUntilNextSessionCompletesOptions,
 } from './search';
@@ -270,7 +186,6 @@ export {
   parseSearchSourceJSON,
   injectSearchSourceReferences,
   extractSearchSourceReferences,
-  getEsPreference,
   getSearchParamsFromRequest,
   noSearchSessionStorageCapabilityMessage,
   SEARCH_SESSIONS_MANAGEMENT_ID,
@@ -282,6 +197,7 @@ export {
 
 export type {
   SearchSource,
+  // TODO: remove these when data_enhanced is merged into data
   ISessionService,
   SearchSessionInfoProvider,
   ISessionsClient,
@@ -354,7 +270,6 @@ export type {
   SavedQuery,
   SavedQueryService,
   SavedQueryTimeFilter,
-  InputTimeRange,
   TimefilterContract,
   TimeHistoryContract,
   QueryStateChange,
diff --git a/src/plugins/data/public/index_patterns/index_pattern.stub.ts b/src/plugins/data/public/index_patterns/index_pattern.stub.ts
index 36569cafd6611f..a203e84af270f9 100644
--- a/src/plugins/data/public/index_patterns/index_pattern.stub.ts
+++ b/src/plugins/data/public/index_patterns/index_pattern.stub.ts
@@ -10,9 +10,10 @@ import sinon from 'sinon';
 
 import { CoreSetup } from 'src/core/public';
 import { SerializedFieldFormat } from 'src/plugins/expressions/public';
-import { IFieldType, FieldSpec } from '../../common/index_patterns';
-import { IndexPattern, indexPatterns, KBN_FIELD_TYPES, fieldList } from '../';
+import { IFieldType, FieldSpec, fieldList } from '../../common/index_patterns';
+import { IndexPattern, KBN_FIELD_TYPES } from '../';
 import { getFieldFormatsRegistry } from '../test_utils';
+import { flattenHitWrapper, formatHitProvider } from './index_patterns';
 
 export function getStubIndexPattern(
   pattern: string,
@@ -81,11 +82,8 @@ export class StubIndexPattern {
     };
 
     this.getComputedFields = IndexPattern.prototype.getComputedFields.bind(this);
-    this.flattenHit = indexPatterns.flattenHitWrapper(
-      (this as unknown) as IndexPattern,
-      this.metaFields
-    );
-    this.formatHit = indexPatterns.formatHitProvider(
+    this.flattenHit = flattenHitWrapper((this as unknown) as IndexPattern, this.metaFields);
+    this.formatHit = formatHitProvider(
       (this as unknown) as IndexPattern,
       registeredFieldFormats.getDefaultInstance(KBN_FIELD_TYPES.STRING)
     );
diff --git a/src/plugins/data/public/mocks.ts b/src/plugins/data/public/mocks.ts
index 9e01350add2e3b..ba1cba987c0b96 100644
--- a/src/plugins/data/public/mocks.ts
+++ b/src/plugins/data/public/mocks.ts
@@ -7,7 +7,7 @@
  */
 
 import { DataPlugin, IndexPatternsContract } from '.';
-import { fieldFormatsServiceMock } from './field_formats/mocks';
+import { fieldFormatsServiceMock } from '../../field_formats/public/mocks';
 import { searchServiceMock } from './search/mocks';
 import { queryServiceMock } from './query/mocks';
 import { AutocompleteStart, AutocompleteSetup } from './autocomplete';
diff --git a/src/plugins/data/public/plugin.ts b/src/plugins/data/public/plugin.ts
index 7a071dbffe696a..46b1d4a14be788 100644
--- a/src/plugins/data/public/plugin.ts
+++ b/src/plugins/data/public/plugin.ts
@@ -19,7 +19,6 @@ import {
 } from './types';
 import { AutocompleteService } from './autocomplete';
 import { SearchService } from './search/search_service';
-import { FieldFormatsService } from './field_formats';
 import { QueryService } from './query';
 import { createIndexPatternSelect } from './ui/index_pattern_select';
 import {
@@ -62,7 +61,6 @@ export class DataPublicPlugin
     > {
   private readonly autocomplete: AutocompleteService;
   private readonly searchService: SearchService;
-  private readonly fieldFormatsService: FieldFormatsService;
   private readonly queryService: QueryService;
   private readonly storage: IStorageWrapper;
   private usageCollection: UsageCollectionSetup | undefined;
@@ -71,7 +69,6 @@ export class DataPublicPlugin
   constructor(initializerContext: PluginInitializerContext<ConfigSchema>) {
     this.searchService = new SearchService(initializerContext);
     this.queryService = new QueryService();
-    this.fieldFormatsService = new FieldFormatsService();
 
     this.autocomplete = new AutocompleteService(initializerContext);
     this.storage = new Storage(window.localStorage);
@@ -80,7 +77,14 @@ export class DataPublicPlugin
 
   public setup(
     core: CoreSetup<DataStartDependencies, DataPublicPluginStart>,
-    { bfetch, expressions, uiActions, usageCollection, inspector }: DataSetupDependencies
+    {
+      bfetch,
+      expressions,
+      uiActions,
+      usageCollection,
+      inspector,
+      fieldFormats,
+    }: DataSetupDependencies
   ): DataPublicPluginSetup {
     const startServices = createStartServicesGetter(core.getStartServices);
 
@@ -115,10 +119,9 @@ export class DataPublicPlugin
       }))
     );
 
-    const fieldFormats = this.fieldFormatsService.setup(core);
     fieldFormats.register(
       getAggsFormats((serializedFieldFormat) =>
-        startServices().self.fieldFormats.deserialize(serializedFieldFormat)
+        startServices().plugins.fieldFormats.deserialize(serializedFieldFormat)
       )
     );
 
@@ -133,14 +136,15 @@ export class DataPublicPlugin
     };
   }
 
-  public start(core: CoreStart, { uiActions }: DataStartDependencies): DataPublicPluginStart {
+  public start(
+    core: CoreStart,
+    { uiActions, fieldFormats }: DataStartDependencies
+  ): DataPublicPluginStart {
     const { uiSettings, http, notifications, savedObjects, overlays, application } = core;
     setNotifications(notifications);
     setOverlays(overlays);
     setUiSettings(uiSettings);
 
-    const fieldFormats = this.fieldFormatsService.start();
-
     const indexPatterns = new IndexPatternsService({
       uiSettings: new UiSettingsPublicToCommon(uiSettings),
       savedObjectsClient: new SavedObjectsClientPublicToCommon(savedObjects.client),
diff --git a/src/plugins/data/public/public.api.md b/src/plugins/data/public/public.api.md
index ce105b8cc94acd..5f5286de4a1aba 100644
--- a/src/plugins/data/public/public.api.md
+++ b/src/plugins/data/public/public.api.md
@@ -8,13 +8,11 @@ import { $Values } from '@kbn/utility-types';
 import { Action } from 'history';
 import { Adapters as Adapters_2 } from 'src/plugins/inspector/common';
 import { ApiResponse } from '@elastic/elasticsearch/lib/Transport';
-import { ApplicationStart } from 'kibana/public';
 import { Assign } from '@kbn/utility-types';
 import { BfetchPublicSetup } from 'src/plugins/bfetch/public';
 import Boom from '@hapi/boom';
 import { ConfigDeprecationProvider } from '@kbn/config';
 import { CoreSetup } from 'src/core/public';
-import { CoreSetup as CoreSetup_2 } from 'kibana/public';
 import { CoreStart } from 'kibana/public';
 import { CoreStart as CoreStart_2 } from 'src/core/public';
 import { CustomFilter as CustomFilter_2 } from '@kbn/es-query';
@@ -43,9 +41,10 @@ import { ExpressionAstExpression } from 'src/plugins/expressions/common';
 import { ExpressionFunctionDefinition } from 'src/plugins/expressions/common';
 import { ExpressionsSetup } from 'src/plugins/expressions/public';
 import { ExpressionValueBoxed } from 'src/plugins/expressions/common';
+import { FieldFormatsSetup } from 'src/plugins/field_formats/public';
+import { FieldFormatsStart } from 'src/plugins/field_formats/public';
 import { Filter as Filter_2 } from '@kbn/es-query';
 import { FilterStateStore } from '@kbn/es-query';
-import { FormatFactory as FormatFactory_2 } from 'src/plugins/data/common/field_formats/utils';
 import { History } from 'history';
 import { Href } from 'history';
 import { HttpSetup } from 'kibana/public';
@@ -107,10 +106,9 @@ import { SavedObjectsFindOptions } from 'kibana/public';
 import { SavedObjectsFindResponse } from 'kibana/server';
 import { SavedObjectsUpdateResponse } from 'kibana/server';
 import { SchemaTypeError } from '@kbn/config-schema';
-import { SerializedFieldFormat as SerializedFieldFormat_2 } from 'src/plugins/expressions/common';
+import { SerializedFieldFormat as SerializedFieldFormat_3 } from 'src/plugins/expressions/common';
 import { StartServicesAccessor } from 'kibana/public';
 import { ToastInputFields } from 'src/core/public/notifications';
-import { ToastsSetup } from 'kibana/public';
 import { TransportRequestOptions } from '@elastic/elasticsearch/lib/Transport';
 import { TransportRequestParams } from '@elastic/elasticsearch/lib/Transport';
 import { TransportRequestPromise } from '@elastic/elasticsearch/lib/Transport';
@@ -191,8 +189,6 @@ export class AggConfig {
     parent?: IAggConfigs;
     // (undocumented)
     schema?: string;
-    // Warning: (ae-incompatible-release-tags) The symbol "serialize" is marked as @public, but its signature references "AggConfigSerialized" which is marked as @internal
-    //
     // (undocumented)
     serialize(): AggConfigSerialized;
     setParams(from: any): void;
@@ -202,12 +198,10 @@ export class AggConfig {
     toDsl(aggConfigs?: IAggConfigs): any;
     // (undocumented)
     toExpressionAst(): ExpressionAstExpression | undefined;
-    // Warning: (ae-incompatible-release-tags) The symbol "toJSON" is marked as @public, but its signature references "AggConfigSerialized" which is marked as @internal
-    //
     // @deprecated (undocumented)
     toJSON(): AggConfigSerialized;
     // Warning: (ae-forgotten-export) The symbol "SerializableState" needs to be exported by the entry point index.d.ts
-    toSerializedFieldFormat(): {} | Ensure<SerializedFieldFormat_2<SerializableState_2>, SerializableState_2>;
+    toSerializedFieldFormat(): {} | Ensure<SerializedFieldFormat_3<SerializableState_2>, SerializableState_2>;
     // (undocumented)
     get type(): IAggType;
     set type(type: IAggType);
@@ -217,7 +211,6 @@ export class AggConfig {
     write(aggs?: IAggConfigs): Record<string, any>;
 }
 
-// Warning: (ae-incompatible-release-tags) The symbol "AggConfigOptions" is marked as @public, but its signature references "AggConfigSerialized" which is marked as @internal
 // Warning: (ae-missing-release-tag) "AggConfigOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -332,7 +325,7 @@ export class AggConfigs {
     toDsl(): Record<string, any>;
     }
 
-// @internal (undocumented)
+// @public (undocumented)
 export type AggConfigSerialized = Ensure<{
     type: string;
     enabled?: boolean;
@@ -531,12 +524,26 @@ export class AggParamType<TAggConfig extends IAggConfig = IAggConfig> extends Ba
     constructor(config: Record<string, any>);
     // (undocumented)
     allowedAggs: string[];
-    // Warning: (ae-incompatible-release-tags) The symbol "makeAgg" is marked as @public, but its signature references "AggConfigSerialized" which is marked as @internal
-    //
     // (undocumented)
     makeAgg: (agg: TAggConfig, state?: AggConfigSerialized) => TAggConfig;
 }
 
+// Warning: (ae-missing-release-tag) "AggregationRestrictions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+type AggregationRestrictions = Record<string, {
+    agg?: string;
+    interval?: number;
+    fixed_interval?: string;
+    calendar_interval?: string;
+    delay?: string;
+    time_zone?: string;
+}>;
+
+export { AggregationRestrictions }
+
+export { AggregationRestrictions as IndexPatternAggRestrictions }
+
 // Warning: (ae-forgotten-export) The symbol "AggsCommonStart" needs to be exported by the entry point index.d.ts
 //
 // @public
@@ -573,13 +580,6 @@ export type AutocompleteStart = ReturnType<AutocompleteService['start']>;
 // @public (undocumented)
 export type AutoRefreshDoneFn = () => void;
 
-// Warning: (ae-forgotten-export) The symbol "DateFormat" needs to be exported by the entry point index.d.ts
-// Warning: (ae-forgotten-export) The symbol "DateNanosFormat" needs to be exported by the entry point index.d.ts
-// Warning: (ae-missing-release-tag) "baseFormattersPublic" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export const baseFormattersPublic: (import("../../common").FieldFormatInstanceType | typeof DateFormat | typeof DateNanosFormat)[];
-
 // Warning: (ae-missing-release-tag) "BUCKET_TYPES" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -644,9 +644,9 @@ export class DataPlugin implements Plugin<DataPublicPluginSetup, DataPublicPlugi
     // Warning: (ae-forgotten-export) The symbol "ConfigSchema" needs to be exported by the entry point index.d.ts
     constructor(initializerContext: PluginInitializerContext_2<ConfigSchema>);
     // (undocumented)
-    setup(core: CoreSetup<DataStartDependencies, DataPublicPluginStart>, { bfetch, expressions, uiActions, usageCollection, inspector }: DataSetupDependencies): DataPublicPluginSetup;
+    setup(core: CoreSetup<DataStartDependencies, DataPublicPluginStart>, { bfetch, expressions, uiActions, usageCollection, inspector, fieldFormats, }: DataSetupDependencies): DataPublicPluginSetup;
     // (undocumented)
-    start(core: CoreStart_2, { uiActions }: DataStartDependencies): DataPublicPluginStart;
+    start(core: CoreStart_2, { uiActions, fieldFormats }: DataStartDependencies): DataPublicPluginStart;
     // (undocumented)
     stop(): void;
     }
@@ -659,9 +659,7 @@ export interface DataPublicPluginSetup {
     //
     // (undocumented)
     autocomplete: AutocompleteSetup;
-    // Warning: (ae-forgotten-export) The symbol "FieldFormatsSetup" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
+    // @deprecated (undocumented)
     fieldFormats: FieldFormatsSetup;
     // (undocumented)
     query: QuerySetup;
@@ -675,6 +673,7 @@ export interface DataPublicPluginSetup {
 export interface DataPublicPluginStart {
     actions: DataPublicPluginStartActions;
     autocomplete: AutocompleteStart;
+    // @deprecated (undocumented)
     fieldFormats: FieldFormatsStart;
     indexPatterns: IndexPatternsContract;
     // Warning: (ae-forgotten-export) The symbol "NowProviderPublicContract" needs to be exported by the entry point index.d.ts
@@ -732,15 +731,6 @@ export const ES_SEARCH_STRATEGY = "es";
 // @public (undocumented)
 export type EsaggsExpressionFunctionDefinition = ExpressionFunctionDefinition<'esaggs', Input_36, Arguments_21, Output_36>;
 
-// Warning: (ae-forgotten-export) The symbol "name" needs to be exported by the entry point index.d.ts
-// Warning: (ae-forgotten-export) The symbol "Input" needs to be exported by the entry point index.d.ts
-// Warning: (ae-forgotten-export) The symbol "Arguments" needs to be exported by the entry point index.d.ts
-// Warning: (ae-forgotten-export) The symbol "Output" needs to be exported by the entry point index.d.ts
-// Warning: (ae-missing-release-tag) "EsdslExpressionFunctionDefinition" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type EsdslExpressionFunctionDefinition = ExpressionFunctionDefinition<typeof name_3, Input_37, Arguments_23, Output_37>;
-
 // Warning: (ae-missing-release-tag) "esFilters" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public @deprecated
@@ -833,14 +823,6 @@ export type EsQueryConfig = EsQueryConfig_2;
 // @public (undocumented)
 export type EsQuerySortValue = Record<string, SortDirection | SortDirectionNumeric | SortDirectionFormat>;
 
-// Warning: (ae-forgotten-export) The symbol "ExpressionTypeDefinition" needs to be exported by the entry point index.d.ts
-// Warning: (ae-forgotten-export) The symbol "name" needs to be exported by the entry point index.d.ts
-// Warning: (ae-forgotten-export) The symbol "EsRawResponse" needs to be exported by the entry point index.d.ts
-// Warning: (ae-missing-release-tag) "EsRawResponseExpressionTypeDefinition" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type EsRawResponseExpressionTypeDefinition = ExpressionTypeDefinition<typeof name_4, EsRawResponse, EsRawResponse>;
-
 // Warning: (ae-missing-release-tag) "ExecutionContextSearch" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -896,125 +878,8 @@ export function extractTimeRange(filters: Filter_2[], timeFieldName?: string): {
     timeRange?: TimeRange;
 };
 
-// Warning: (ae-missing-release-tag) "FieldFormat" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export abstract class FieldFormat {
-    // Warning: (ae-forgotten-export) The symbol "IFieldFormatMetaParams" needs to be exported by the entry point index.d.ts
-    constructor(_params?: IFieldFormatMetaParams, getConfig?: FieldFormatsGetConfigFn);
-    // (undocumented)
-    allowsNumericalAggregations?: boolean;
-    // Warning: (ae-forgotten-export) The symbol "HtmlContextTypeOptions" needs to be exported by the entry point index.d.ts
-    // Warning: (ae-forgotten-export) The symbol "TextContextTypeOptions" needs to be exported by the entry point index.d.ts
-    convert(value: any, contentType?: FieldFormatsContentType, options?: HtmlContextTypeOptions | TextContextTypeOptions): string;
-    // Warning: (ae-forgotten-export) The symbol "FieldFormatConvert" needs to be exported by the entry point index.d.ts
-    convertObject: FieldFormatConvert | undefined;
-    static fieldType: string | string[];
-    // Warning: (ae-incompatible-release-tags) The symbol "from" is marked as @public, but its signature references "FieldFormatInstanceType" which is marked as @internal
-    //
-    // (undocumented)
-    static from(convertFn: FieldFormatConvertFunction): FieldFormatInstanceType;
-    // (undocumented)
-    protected getConfig: FieldFormatsGetConfigFn | undefined;
-    // Warning: (ae-forgotten-export) The symbol "FieldFormatConvertFunction" needs to be exported by the entry point index.d.ts
-    getConverterFor(contentType?: FieldFormatsContentType): FieldFormatConvertFunction;
-    getParamDefaults(): Record<string, any>;
-    static hidden: boolean;
-    // Warning: (ae-forgotten-export) The symbol "HtmlContextTypeConvert" needs to be exported by the entry point index.d.ts
-    htmlConvert: HtmlContextTypeConvert | undefined;
-    static id: string;
-    // (undocumented)
-    static isInstanceOfFieldFormat(fieldFormat: any): fieldFormat is FieldFormat;
-    param(name: string): any;
-    params(): Record<string, any>;
-    // (undocumented)
-    protected readonly _params: any;
-    // (undocumented)
-    setupContentType(): FieldFormatConvert;
-    // Warning: (ae-forgotten-export) The symbol "TextContextTypeConvert" needs to be exported by the entry point index.d.ts
-    textConvert: TextContextTypeConvert | undefined;
-    static title: string;
-    toJSON(): {
-        id: any;
-        params: any;
-    };
-    type: any;
-}
-
-// Warning: (ae-missing-release-tag) "FieldFormatConfig" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export interface FieldFormatConfig {
-    // (undocumented)
-    es?: boolean;
-    // (undocumented)
-    id: FieldFormatId;
-    // (undocumented)
-    params: Record<string, any>;
-}
-
-// Warning: (ae-forgotten-export) The symbol "FIELD_FORMAT_IDS" needs to be exported by the entry point index.d.ts
-// Warning: (ae-missing-release-tag) "FieldFormatId" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public
-export type FieldFormatId = FIELD_FORMAT_IDS | string;
-
-// @internal (undocumented)
-export type FieldFormatInstanceType = (new (params?: any, getConfig?: FieldFormatsGetConfigFn) => FieldFormat) & {
-    id: FieldFormatId;
-    title: string;
-    hidden?: boolean;
-    fieldType: string | string[];
-};
-
-// Warning: (ae-missing-release-tag) "fieldFormats" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export const fieldFormats: {
-    FieldFormat: typeof FieldFormat;
-    FieldFormatsRegistry: typeof FieldFormatsRegistry;
-    DEFAULT_CONVERTER_COLOR: {
-        range: string;
-        regex: string;
-        text: string;
-        background: string;
-    };
-    HTML_CONTEXT_TYPE: import("../common").FieldFormatsContentType;
-    TEXT_CONTEXT_TYPE: import("../common").FieldFormatsContentType;
-    FIELD_FORMAT_IDS: typeof FIELD_FORMAT_IDS;
-    BoolFormat: typeof BoolFormat;
-    BytesFormat: typeof BytesFormat;
-    ColorFormat: typeof ColorFormat;
-    DateFormat: typeof DateFormat;
-    DateNanosFormat: typeof DateNanosFormat;
-    DurationFormat: typeof DurationFormat;
-    IpFormat: typeof IpFormat;
-    NumberFormat: typeof NumberFormat;
-    PercentFormat: typeof PercentFormat;
-    RelativeDateFormat: typeof RelativeDateFormat;
-    SourceFormat: typeof SourceFormat;
-    StaticLookupFormat: typeof StaticLookupFormat;
-    UrlFormat: typeof UrlFormat;
-    StringFormat: typeof StringFormat;
-    TruncateFormat: typeof TruncateFormat;
-    HistogramFormat: typeof HistogramFormat;
-};
-
-// @public (undocumented)
-export type FieldFormatsContentType = 'html' | 'text';
-
-// Warning: (ae-forgotten-export) The symbol "GetConfigFn" needs to be exported by the entry point index.d.ts
-// Warning: (ae-missing-release-tag) "FieldFormatsGetConfigFn" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type FieldFormatsGetConfigFn = GetConfigFn;
-
-// @public (undocumented)
-export type FieldFormatsStart = Omit<FieldFormatsRegistry, 'init' | 'register'> & {
-    deserialize: FormatFactory;
-};
-
 // Warning: (ae-forgotten-export) The symbol "FieldSpec" needs to be exported by the entry point index.d.ts
+// Warning: (ae-forgotten-export) The symbol "IIndexPatternFieldList" needs to be exported by the entry point index.d.ts
 // Warning: (ae-missing-release-tag) "fieldList" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -1100,18 +965,30 @@ export function getDefaultQuery(language?: QueryLanguage): {
 // @public (undocumented)
 export function getDisplayValueFromFilter(filter: Filter, indexPatterns: IIndexPattern[]): string;
 
-// Warning: (ae-forgotten-export) The symbol "IUiSettingsClient" needs to be exported by the entry point index.d.ts
-// Warning: (ae-missing-release-tag) "getEsPreference" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export function getEsPreference(uiSettings: IUiSettingsClient_2, sessionId?: string): any;
-
 // Warning: (ae-forgotten-export) The symbol "KibanaConfig" needs to be exported by the entry point index.d.ts
 // Warning: (ae-missing-release-tag) "getEsQueryConfig" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
 export function getEsQueryConfig(config: KibanaConfig): EsQueryConfig_2;
 
+// Warning: (ae-missing-release-tag) "GetFieldsOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export interface GetFieldsOptions {
+    // (undocumented)
+    allowNoIndex?: boolean;
+    // (undocumented)
+    lookBack?: boolean;
+    // (undocumented)
+    metaFields?: string[];
+    // (undocumented)
+    pattern: string;
+    // (undocumented)
+    rollupIndex?: string;
+    // (undocumented)
+    type?: string;
+}
+
 // Warning: (ae-missing-release-tag) "getKbnTypeNames" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public @deprecated (undocumented)
@@ -1191,16 +1068,6 @@ export interface IEsSearchRequest extends IKibanaSearchRequest<ISearchRequestPar
 // @public (undocumented)
 export type IEsSearchResponse<Source = any> = IKibanaSearchResponse<estypes.SearchResponse<Source>>;
 
-// Warning: (ae-missing-release-tag) "IFieldFormat" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type IFieldFormat = FieldFormat;
-
-// Warning: (ae-missing-release-tag) "IFieldFormatsRegistry" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type IFieldFormatsRegistry = PublicMethodsOf<FieldFormatsRegistry>;
-
 // Warning: (ae-forgotten-export) The symbol "FieldParamType" needs to be exported by the entry point index.d.ts
 // Warning: (ae-missing-release-tag) "IFieldParamType" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
@@ -1254,6 +1121,7 @@ export interface IIndexPattern extends IndexPatternBase {
     fieldFormatMap?: Record<string, SerializedFieldFormat<unknown> | undefined>;
     // (undocumented)
     fields: IFieldType[];
+    // Warning: (ae-forgotten-export) The symbol "FieldFormat" needs to be exported by the entry point index.d.ts
     getFormatterForField?: (field: IndexPatternField | IndexPatternField['spec'] | IFieldType) => FieldFormat;
     // (undocumented)
     getTimeField?(): IFieldType | undefined;
@@ -1264,34 +1132,6 @@ export interface IIndexPattern extends IndexPatternBase {
     type?: string;
 }
 
-// Warning: (ae-missing-release-tag) "IIndexPatternFieldList" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export interface IIndexPatternFieldList extends Array<IndexPatternField> {
-    // (undocumented)
-    add(field: FieldSpec): void;
-    // (undocumented)
-    getAll(): IndexPatternField[];
-    // (undocumented)
-    getByName(name: IndexPatternField['name']): IndexPatternField | undefined;
-    // (undocumented)
-    getByType(type: IndexPatternField['type']): IndexPatternField[];
-    // (undocumented)
-    remove(field: IFieldType): void;
-    // (undocumented)
-    removeAll(): void;
-    // (undocumented)
-    replaceAll(specs: FieldSpec[]): void;
-    // Warning: (ae-forgotten-export) The symbol "IndexPatternFieldMap" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    toSpec(options?: {
-        getFormatterForField?: IndexPattern['getFormatterForField'];
-    }): IndexPatternFieldMap;
-    // (undocumented)
-    update(field: FieldSpec): void;
-}
-
 // Warning: (ae-missing-release-tag) "IKibanaSearchRequest" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -1433,22 +1273,11 @@ export class IndexPattern implements IIndexPattern {
     title: string;
     toSpec(): IndexPatternSpec;
     type: string | undefined;
-    typeMeta?: IndexPatternTypeMeta;
+    // Warning: (ae-forgotten-export) The symbol "TypeMeta" needs to be exported by the entry point index.d.ts
+    typeMeta?: TypeMeta;
     version: string | undefined;
 }
 
-// Warning: (ae-missing-release-tag) "AggregationRestrictions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type IndexPatternAggRestrictions = Record<string, {
-    agg?: string;
-    interval?: number;
-    fixed_interval?: string;
-    calendar_interval?: string;
-    delay?: string;
-    time_zone?: string;
-}>;
-
 // Warning: (ae-missing-release-tag) "IndexPatternAttributes" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public
@@ -1566,7 +1395,6 @@ export const indexPatterns: {
     isNestedField: typeof isNestedField;
     validate: typeof validateIndexPattern;
     flattenHitWrapper: typeof flattenHitWrapper;
-    formatHitProvider: typeof formatHitProvider;
 };
 
 // Warning: (ae-missing-release-tag) "IndexPatternsContract" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
@@ -1611,7 +1439,7 @@ export interface IndexPatternSpec {
     // (undocumented)
     type?: string;
     // (undocumented)
-    typeMeta?: IndexPatternTypeMeta;
+    typeMeta?: TypeMeta;
     version?: string;
 }
 
@@ -1640,7 +1468,6 @@ export class IndexPatternsService {
     getDefault: () => Promise<IndexPattern | null>;
     getDefaultId: () => Promise<string | null>;
     getFieldsForIndexPattern: (indexPattern: IndexPattern | IndexPatternSpec, options?: GetFieldsOptions | undefined) => Promise<any>;
-    // Warning: (ae-forgotten-export) The symbol "GetFieldsOptions" needs to be exported by the entry point index.d.ts
     getFieldsForWildcard: (options: GetFieldsOptions) => Promise<any>;
     getIds: (refresh?: boolean) => Promise<string[]>;
     getIdsWithTitle: (refresh?: boolean) => Promise<Array<{
@@ -1664,18 +1491,6 @@ export enum IndexPatternType {
     ROLLUP = "rollup"
 }
 
-// Warning: (ae-missing-release-tag) "TypeMeta" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export interface IndexPatternTypeMeta {
-    // (undocumented)
-    aggs?: Record<string, IndexPatternAggRestrictions>;
-    // (undocumented)
-    params?: {
-        rollup_index: string;
-    };
-}
-
 // Warning: (ae-missing-release-tag) "injectReferences" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -1683,14 +1498,6 @@ export const injectSearchSourceReferences: (searchSourceFields: SearchSourceFiel
     indexRefName: string;
 }, references: SavedObjectReference_2[]) => SearchSourceFields;
 
-// Warning: (ae-missing-release-tag) "InputTimeRange" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type InputTimeRange = TimeRange | {
-    from: Moment;
-    to: Moment;
-};
-
 // Warning: (ae-missing-release-tag) "isCompleteResponse" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -1898,20 +1705,6 @@ export interface OptionedValueProp {
     value: string;
 }
 
-// Warning: (ae-forgotten-export) The symbol "EsError" needs to be exported by the entry point index.d.ts
-// Warning: (ae-missing-release-tag) "PainlessError" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export class PainlessError extends EsError {
-    constructor(err: IEsError, indexPattern?: IndexPattern);
-    // (undocumented)
-    getErrorMessage(application: ApplicationStart): JSX.Element;
-    // (undocumented)
-    indexPattern?: IndexPattern;
-    // (undocumented)
-    painlessStack?: string;
-}
-
 // Warning: (ae-forgotten-export) The symbol "parseEsInterval" needs to be exported by the entry point index.d.ts
 // Warning: (ae-missing-release-tag) "ParsedInterval" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
@@ -2035,6 +1828,7 @@ export interface QueryStringInputProps {
     storageKey?: string;
     // (undocumented)
     submitOnBlur?: boolean;
+    timeRangeForSuggestionsOverride?: boolean;
 }
 
 // @public (undocumented)
@@ -2276,59 +2070,6 @@ export const SearchBar: React.ComponentClass<Pick<Pick<SearchBarProps, "query" |
 // @public (undocumented)
 export type SearchBarProps = SearchBarOwnProps & SearchBarInjectedDeps;
 
-// Warning: (ae-missing-release-tag) "SearchError" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export interface SearchError {
-    // (undocumented)
-    message: string;
-    // (undocumented)
-    name: string;
-    // (undocumented)
-    path: string;
-    // (undocumented)
-    status: string;
-    // (undocumented)
-    title: string;
-    // (undocumented)
-    type: string;
-}
-
-// Warning: (ae-missing-release-tag) "SearchInterceptor" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export class SearchInterceptor {
-    constructor(deps: SearchInterceptorDeps);
-    // Warning: (ae-forgotten-export) The symbol "IAsyncSearchOptions" needs to be exported by the entry point index.d.ts
-    search({ id, ...request }: IKibanaSearchRequest, options?: IAsyncSearchOptions): import("rxjs").Observable<IKibanaSearchResponse<any>>;
-    // (undocumented)
-    showError(e: Error): void;
-    // (undocumented)
-    stop(): void;
-    }
-
-// Warning: (ae-missing-release-tag) "SearchInterceptorDeps" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export interface SearchInterceptorDeps {
-    // (undocumented)
-    bfetch: BfetchPublicSetup;
-    // (undocumented)
-    http: CoreSetup_2['http'];
-    // (undocumented)
-    session: ISessionService;
-    // (undocumented)
-    startServices: Promise<[CoreStart, any, unknown]>;
-    // (undocumented)
-    toasts: ToastsSetup;
-    // (undocumented)
-    uiSettings: CoreSetup_2['uiSettings'];
-    // Warning: (ae-incompatible-release-tags) The symbol "usageCollector" is marked as @public, but its signature references "SearchUsageCollector" which is marked as @internal
-    //
-    // (undocumented)
-    usageCollector?: SearchUsageCollector;
-}
-
 // @internal
 export type SearchRequest = Record<string, any>;
 
@@ -2444,18 +2185,6 @@ export interface SearchSourceFields {
     version?: boolean;
 }
 
-// Warning: (ae-forgotten-export) The symbol "KbnError" needs to be exported by the entry point index.d.ts
-// Warning: (ae-missing-release-tag) "SearchTimeoutError" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public
-export class SearchTimeoutError extends KbnError {
-    constructor(err: Record<string, any>, mode: TimeoutErrorMode);
-    // (undocumented)
-    getErrorMessage(application: ApplicationStart): JSX.Element;
-    // (undocumented)
-    mode: TimeoutErrorMode;
-    }
-
 // @internal (undocumented)
 export interface SearchUsageCollector {
     // (undocumented)
@@ -2539,16 +2268,6 @@ export class TimeHistory {
 // @public (undocumented)
 export type TimeHistoryContract = PublicMethodsOf<TimeHistory>;
 
-// Warning: (ae-missing-release-tag) "TimeoutErrorMode" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export enum TimeoutErrorMode {
-    // (undocumented)
-    CHANGE = 1,
-    // (undocumented)
-    CONTACT = 0
-}
-
 // Warning: (ae-missing-release-tag) "TimeRange" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -2578,13 +2297,6 @@ export const UI_SETTINGS: {
     readonly HISTOGRAM_BAR_TARGET: "histogram:barTarget";
     readonly HISTOGRAM_MAX_BARS: "histogram:maxBars";
     readonly HISTORY_LIMIT: "history:limit";
-    readonly SHORT_DOTS_ENABLE: "shortDots:enable";
-    readonly FORMAT_DEFAULT_TYPE_MAP: "format:defaultTypeMap";
-    readonly FORMAT_NUMBER_DEFAULT_PATTERN: "format:number:defaultPattern";
-    readonly FORMAT_PERCENT_DEFAULT_PATTERN: "format:percent:defaultPattern";
-    readonly FORMAT_BYTES_DEFAULT_PATTERN: "format:bytes:defaultPattern";
-    readonly FORMAT_CURRENCY_DEFAULT_PATTERN: "format:currency:defaultPattern";
-    readonly FORMAT_NUMBER_DEFAULT_LOCALE: "format:number:defaultLocale";
     readonly TIMEPICKER_REFRESH_INTERVAL_DEFAULTS: "timepicker:refreshIntervalDefaults";
     readonly TIMEPICKER_QUICK_RANGES: "timepicker:quickRanges";
     readonly TIMEPICKER_TIME_DEFAULTS: "timepicker:timeDefaults";
@@ -2610,49 +2322,34 @@ export interface WaitUntilNextSessionCompletesOptions {
 
 // Warnings were encountered during analysis:
 //
+// src/plugins/data/common/index_patterns/index_patterns/index_pattern.ts:52:45 - (ae-forgotten-export) The symbol "IndexPatternFieldMap" needs to be exported by the entry point index.d.ts
 // src/plugins/data/common/index_patterns/index_patterns/index_pattern.ts:66:5 - (ae-forgotten-export) The symbol "FormatFieldFn" needs to be exported by the entry point index.d.ts
 // src/plugins/data/common/index_patterns/index_patterns/index_pattern.ts:139:7 - (ae-forgotten-export) The symbol "FieldAttrSet" needs to be exported by the entry point index.d.ts
 // src/plugins/data/common/index_patterns/index_patterns/index_pattern.ts:170:7 - (ae-forgotten-export) The symbol "RuntimeField" needs to be exported by the entry point index.d.ts
 // src/plugins/data/common/search/aggs/types.ts:128:51 - (ae-forgotten-export) The symbol "AggTypesRegistryStart" needs to be exported by the entry point index.d.ts
+// src/plugins/data/common/search/search_source/fetch/get_search_params.ts:35:19 - (ae-forgotten-export) The symbol "GetConfigFn" needs to be exported by the entry point index.d.ts
 // src/plugins/data/public/deprecated.ts:98:23 - (ae-forgotten-export) The symbol "changeTimeFilter" needs to be exported by the entry point index.d.ts
 // src/plugins/data/public/deprecated.ts:98:23 - (ae-forgotten-export) The symbol "convertRangeFilterToTimeRangeString" needs to be exported by the entry point index.d.ts
 // src/plugins/data/public/deprecated.ts:98:23 - (ae-forgotten-export) The symbol "extractTimeFilter" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/field_formats/field_formats_service.ts:51:3 - (ae-forgotten-export) The symbol "FormatFactory" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:53:26 - (ae-forgotten-export) The symbol "FieldFormatsRegistry" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:53:26 - (ae-forgotten-export) The symbol "BoolFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:53:26 - (ae-forgotten-export) The symbol "BytesFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:53:26 - (ae-forgotten-export) The symbol "ColorFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:53:26 - (ae-forgotten-export) The symbol "DurationFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:53:26 - (ae-forgotten-export) The symbol "IpFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:53:26 - (ae-forgotten-export) The symbol "NumberFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:53:26 - (ae-forgotten-export) The symbol "PercentFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:53:26 - (ae-forgotten-export) The symbol "RelativeDateFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:53:26 - (ae-forgotten-export) The symbol "SourceFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:53:26 - (ae-forgotten-export) The symbol "StaticLookupFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:53:26 - (ae-forgotten-export) The symbol "UrlFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:53:26 - (ae-forgotten-export) The symbol "StringFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:53:26 - (ae-forgotten-export) The symbol "TruncateFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:53:26 - (ae-forgotten-export) The symbol "HistogramFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:96:23 - (ae-forgotten-export) The symbol "datatableToCSV" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:123:27 - (ae-forgotten-export) The symbol "isFilterable" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:123:27 - (ae-forgotten-export) The symbol "isNestedField" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:123:27 - (ae-forgotten-export) The symbol "validateIndexPattern" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:123:27 - (ae-forgotten-export) The symbol "flattenHitWrapper" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:123:27 - (ae-forgotten-export) The symbol "formatHitProvider" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:294:20 - (ae-forgotten-export) The symbol "getResponseInspectorStats" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:294:20 - (ae-forgotten-export) The symbol "tabifyAggResponse" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:294:20 - (ae-forgotten-export) The symbol "tabifyGetColumns" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:296:1 - (ae-forgotten-export) The symbol "CidrMask" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:297:1 - (ae-forgotten-export) The symbol "dateHistogramInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:306:1 - (ae-forgotten-export) The symbol "InvalidEsCalendarIntervalError" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:307:1 - (ae-forgotten-export) The symbol "InvalidEsIntervalFormatError" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:308:1 - (ae-forgotten-export) The symbol "IpAddress" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:309:1 - (ae-forgotten-export) The symbol "isDateHistogramBucketAggConfig" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:313:1 - (ae-forgotten-export) The symbol "isValidEsInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:314:1 - (ae-forgotten-export) The symbol "isValidInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:317:1 - (ae-forgotten-export) The symbol "parseInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:318:1 - (ae-forgotten-export) The symbol "propFilter" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:321:1 - (ae-forgotten-export) The symbol "toAbsoluteDates" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:27:23 - (ae-forgotten-export) The symbol "datatableToCSV" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:53:27 - (ae-forgotten-export) The symbol "isFilterable" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:53:27 - (ae-forgotten-export) The symbol "isNestedField" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:53:27 - (ae-forgotten-export) The symbol "validateIndexPattern" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:53:27 - (ae-forgotten-export) The symbol "flattenHitWrapper" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:210:20 - (ae-forgotten-export) The symbol "getResponseInspectorStats" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:210:20 - (ae-forgotten-export) The symbol "tabifyAggResponse" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:210:20 - (ae-forgotten-export) The symbol "tabifyGetColumns" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:212:1 - (ae-forgotten-export) The symbol "CidrMask" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:213:1 - (ae-forgotten-export) The symbol "dateHistogramInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:222:1 - (ae-forgotten-export) The symbol "InvalidEsCalendarIntervalError" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:223:1 - (ae-forgotten-export) The symbol "InvalidEsIntervalFormatError" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:224:1 - (ae-forgotten-export) The symbol "IpAddress" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:225:1 - (ae-forgotten-export) The symbol "isDateHistogramBucketAggConfig" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:229:1 - (ae-forgotten-export) The symbol "isValidEsInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:230:1 - (ae-forgotten-export) The symbol "isValidInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:233:1 - (ae-forgotten-export) The symbol "parseInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:234:1 - (ae-forgotten-export) The symbol "propFilter" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:237:1 - (ae-forgotten-export) The symbol "toAbsoluteDates" needs to be exported by the entry point index.d.ts
 // src/plugins/data/public/search/session/session_service.ts:62:5 - (ae-forgotten-export) The symbol "UrlGeneratorStateMapping" needs to be exported by the entry point index.d.ts
 
 // (No @packageDocumentation comment for this package)
diff --git a/src/plugins/data/public/search/aggs/aggs_service.test.ts b/src/plugins/data/public/search/aggs/aggs_service.test.ts
index cd2ee69d33996e..563fd5d0440730 100644
--- a/src/plugins/data/public/search/aggs/aggs_service.test.ts
+++ b/src/plugins/data/public/search/aggs/aggs_service.test.ts
@@ -11,7 +11,7 @@ import { BehaviorSubject, Subscription } from 'rxjs';
 import { coreMock } from '../../../../../core/public/mocks';
 import { expressionsPluginMock } from '../../../../../plugins/expressions/public/mocks';
 import { BucketAggType, getAggTypes, MetricAggType } from '../../../common';
-import { fieldFormatsServiceMock } from '../../field_formats/mocks';
+import { fieldFormatsServiceMock } from '../../../../field_formats/public/mocks';
 import { dataPluginMock } from '../../mocks';
 
 import {
diff --git a/src/plugins/data/public/search/aggs/aggs_service.ts b/src/plugins/data/public/search/aggs/aggs_service.ts
index f603bd733f6014..3f91ced6de9504 100644
--- a/src/plugins/data/public/search/aggs/aggs_service.ts
+++ b/src/plugins/data/public/search/aggs/aggs_service.ts
@@ -10,7 +10,7 @@ import { Subscription } from 'rxjs';
 
 import { IUiSettingsClient } from 'src/core/public';
 import { ExpressionsServiceSetup } from 'src/plugins/expressions/common';
-import { FieldFormatsStart } from '../../field_formats';
+import { FieldFormatsStart } from '../../../../field_formats/public';
 import { calculateBounds, TimeRange } from '../../../common';
 import {
   aggsRequiredUiSettings,
diff --git a/src/plugins/data/public/test_utils.ts b/src/plugins/data/public/test_utils.ts
index b964ddbd2a379d..613e3850c922ec 100644
--- a/src/plugins/data/public/test_utils.ts
+++ b/src/plugins/data/public/test_utils.ts
@@ -6,5 +6,5 @@
  * Side Public License, v 1.
  */
 
-export { getFieldFormatsRegistry } from './field_formats/field_formats_registry.stub';
+export { getFieldFormatsRegistry } from '../../field_formats/public/mocks';
 export { getStubIndexPattern, StubIndexPattern } from './index_patterns/index_pattern.stub';
diff --git a/src/plugins/data/public/types.ts b/src/plugins/data/public/types.ts
index 5ba4ba2bc48afb..d8bfcfdb6ddb13 100644
--- a/src/plugins/data/public/types.ts
+++ b/src/plugins/data/public/types.ts
@@ -12,8 +12,8 @@ import { BfetchPublicSetup } from 'src/plugins/bfetch/public';
 import { IStorageWrapper } from 'src/plugins/kibana_utils/public';
 import { ExpressionsSetup } from 'src/plugins/expressions/public';
 import { UiActionsSetup, UiActionsStart } from 'src/plugins/ui_actions/public';
+import { FieldFormatsSetup, FieldFormatsStart } from 'src/plugins/field_formats/public';
 import { AutocompleteSetup, AutocompleteStart } from './autocomplete';
-import { FieldFormatsSetup, FieldFormatsStart } from './field_formats';
 import { createFiltersFromRangeSelectAction, createFiltersFromValueClickAction } from './actions';
 import { ISearchSetup, ISearchStart } from './search';
 import { QuerySetup, QueryStart } from './query';
@@ -29,10 +29,12 @@ export interface DataSetupDependencies {
   uiActions: UiActionsSetup;
   inspector: InspectorSetup;
   usageCollection?: UsageCollectionSetup;
+  fieldFormats: FieldFormatsSetup;
 }
 
 export interface DataStartDependencies {
   uiActions: UiActionsStart;
+  fieldFormats: FieldFormatsStart;
 }
 
 /**
@@ -41,6 +43,9 @@ export interface DataStartDependencies {
 export interface DataPublicPluginSetup {
   autocomplete: AutocompleteSetup;
   search: ISearchSetup;
+  /**
+   * @deprecated Use fieldFormats plugin instead
+   */
   fieldFormats: FieldFormatsSetup;
   query: QuerySetup;
 }
@@ -86,8 +91,7 @@ export interface DataPublicPluginStart {
    */
   search: ISearchStart;
   /**
-   * field formats service
-   * {@link FieldFormatsStart}
+   * @deprecated Use fieldFormats plugin instead
    */
   fieldFormats: FieldFormatsStart;
   /**
diff --git a/src/plugins/data/public/ui/filter_bar/filter_bar.tsx b/src/plugins/data/public/ui/filter_bar/filter_bar.tsx
index 70f25bd510ef01..09fd818f23703f 100644
--- a/src/plugins/data/public/ui/filter_bar/filter_bar.tsx
+++ b/src/plugins/data/public/ui/filter_bar/filter_bar.tsx
@@ -37,6 +37,7 @@ interface Props {
   indexPatterns: IIndexPattern[];
   intl: InjectedIntl;
   appName: string;
+  timeRangeForSuggestionsOverride?: boolean;
 }
 
 function FilterBarUI(props: Props) {
@@ -65,6 +66,7 @@ function FilterBarUI(props: Props) {
           onRemove={() => onRemove(i)}
           indexPatterns={props.indexPatterns}
           uiSettings={uiSettings!}
+          timeRangeForSuggestionsOverride={props.timeRangeForSuggestionsOverride}
         />
       </EuiFlexItem>
     ));
@@ -112,6 +114,7 @@ function FilterBarUI(props: Props) {
                 onSubmit={onAdd}
                 onCancel={() => setIsAddFilterPopoverOpen(false)}
                 key={JSON.stringify(newFilter)}
+                timeRangeForSuggestionsOverride={props.timeRangeForSuggestionsOverride}
               />
             </div>
           </EuiFlexItem>
diff --git a/src/plugins/data/public/ui/filter_bar/filter_editor/index.tsx b/src/plugins/data/public/ui/filter_bar/filter_editor/index.tsx
index 90ca8e0783a20f..7d1765ddd7f79a 100644
--- a/src/plugins/data/public/ui/filter_bar/filter_editor/index.tsx
+++ b/src/plugins/data/public/ui/filter_bar/filter_editor/index.tsx
@@ -54,6 +54,7 @@ export interface Props {
   onSubmit: (filter: Filter) => void;
   onCancel: () => void;
   intl: InjectedIntl;
+  timeRangeForSuggestionsOverride?: boolean;
 }
 
 interface State {
@@ -356,6 +357,7 @@ class FilterEditorUI extends Component<Props, State> {
             value={this.state.params}
             onChange={this.onParamsChange}
             data-test-subj="phraseValueInput"
+            timeRangeForSuggestionsOverride={this.props.timeRangeForSuggestionsOverride}
             fullWidth
           />
         );
@@ -366,6 +368,7 @@ class FilterEditorUI extends Component<Props, State> {
             field={this.state.selectedField}
             values={this.state.params}
             onChange={this.onParamsChange}
+            timeRangeForSuggestionsOverride={this.props.timeRangeForSuggestionsOverride}
             fullWidth
           />
         );
diff --git a/src/plugins/data/public/ui/filter_bar/filter_editor/phrase_suggestor.tsx b/src/plugins/data/public/ui/filter_bar/filter_editor/phrase_suggestor.tsx
index 779e365969e170..fb3106e6a8f06b 100644
--- a/src/plugins/data/public/ui/filter_bar/filter_editor/phrase_suggestor.tsx
+++ b/src/plugins/data/public/ui/filter_bar/filter_editor/phrase_suggestor.tsx
@@ -17,6 +17,7 @@ export interface PhraseSuggestorProps {
   kibana: KibanaReactContextValue<IDataPluginServices>;
   indexPattern: IIndexPattern;
   field?: IFieldType;
+  timeRangeForSuggestionsOverride?: boolean;
 }
 
 export interface PhraseSuggestorState {
@@ -63,7 +64,8 @@ export class PhraseSuggestorUI<T extends PhraseSuggestorProps> extends React.Com
   protected updateSuggestions = debounce(async (query: string = '') => {
     if (this.abortController) this.abortController.abort();
     this.abortController = new AbortController();
-    const { indexPattern, field } = this.props as PhraseSuggestorProps;
+    const { indexPattern, field, timeRangeForSuggestionsOverride } = this
+      .props as PhraseSuggestorProps;
     if (!field || !this.isSuggestingValues()) {
       return;
     }
@@ -74,8 +76,7 @@ export class PhraseSuggestorUI<T extends PhraseSuggestorProps> extends React.Com
       field,
       query,
       signal: this.abortController.signal,
-      // Show all results in filter bar autocomplete
-      useTimeRange: false,
+      useTimeRange: timeRangeForSuggestionsOverride,
     });
 
     this.setState({ suggestions, isLoading: false });
diff --git a/src/plugins/data/public/ui/filter_bar/filter_item.tsx b/src/plugins/data/public/ui/filter_bar/filter_item.tsx
index b37fc9108ccd2f..acc908e7991519 100644
--- a/src/plugins/data/public/ui/filter_bar/filter_item.tsx
+++ b/src/plugins/data/public/ui/filter_bar/filter_item.tsx
@@ -36,6 +36,7 @@ export interface FilterItemProps {
   intl: InjectedIntl;
   uiSettings: IUiSettingsClient;
   hiddenPanelOptions?: PanelOptions[];
+  timeRangeForSuggestionsOverride?: boolean;
 }
 
 interface LabelOptions {
@@ -253,6 +254,7 @@ export function FilterItem(props: FilterItemProps) {
               onCancel={() => {
                 setIsPopoverOpen(false);
               }}
+              timeRangeForSuggestionsOverride={props.timeRangeForSuggestionsOverride}
             />
           </div>
         ),
diff --git a/src/plugins/data/public/ui/query_string_input/query_bar_top_row.tsx b/src/plugins/data/public/ui/query_string_input/query_bar_top_row.tsx
index abb0de19698d74..f71a3d3b0686a6 100644
--- a/src/plugins/data/public/ui/query_string_input/query_bar_top_row.tsx
+++ b/src/plugins/data/public/ui/query_string_input/query_bar_top_row.tsx
@@ -59,6 +59,7 @@ export interface QueryBarTopRowProps {
   isClearable?: boolean;
   nonKqlMode?: 'lucene' | 'text';
   nonKqlModeHelpText?: string;
+  timeRangeForSuggestionsOverride?: boolean;
 }
 
 // Needed for React.lazy
@@ -190,6 +191,7 @@ export default function QueryBarTopRow(props: QueryBarTopRowProps) {
             iconType={props.iconType}
             nonKqlMode={props.nonKqlMode}
             nonKqlModeHelpText={props.nonKqlModeHelpText}
+            timeRangeForSuggestionsOverride={props.timeRangeForSuggestionsOverride}
           />
         </AutocompleteFtuePopover>
       </EuiFlexItem>
diff --git a/src/plugins/data/public/ui/query_string_input/query_string_input.tsx b/src/plugins/data/public/ui/query_string_input/query_string_input.tsx
index 0f660f87266fd8..62a561220e7fa6 100644
--- a/src/plugins/data/public/ui/query_string_input/query_string_input.tsx
+++ b/src/plugins/data/public/ui/query_string_input/query_string_input.tsx
@@ -76,6 +76,11 @@ export interface QueryStringInputProps {
    * @param storageKey this key is used to use user preference between kql and non-kql mode
    */
   storageKey?: string;
+
+  /**
+   * Override whether autocomplete suggestions are restricted by time range.
+   */
+  timeRangeForSuggestionsOverride?: boolean;
 }
 
 interface Props extends QueryStringInputProps {
@@ -211,6 +216,7 @@ export default class QueryStringInputUI extends Component<Props, State> {
           selectionStart,
           selectionEnd,
           signal: this.abortController.signal,
+          useTimeRange: this.props.timeRangeForSuggestionsOverride,
         })) || [];
       return [...suggestions, ...recentSearchSuggestions];
     } catch (e) {
diff --git a/src/plugins/data/public/ui/search_bar/search_bar.tsx b/src/plugins/data/public/ui/search_bar/search_bar.tsx
index 1608b68ed01b22..a03e7b33d2b659 100644
--- a/src/plugins/data/public/ui/search_bar/search_bar.tsx
+++ b/src/plugins/data/public/ui/search_bar/search_bar.tsx
@@ -14,12 +14,13 @@ import { get, isEqual } from 'lodash';
 import { EuiIconProps } from '@elastic/eui';
 
 import { METRIC_TYPE } from '@kbn/analytics';
+import { Query, Filter } from '@kbn/es-query';
 import { withKibana, KibanaReactContextValue } from '../../../../kibana_react/public';
 
 import QueryBarTopRow from '../query_string_input/query_bar_top_row';
 import { SavedQueryAttributes, TimeHistoryContract, SavedQuery } from '../../query';
 import { IDataPluginServices } from '../../types';
-import { TimeRange, Query, Filter, IIndexPattern } from '../../../common';
+import { TimeRange, IIndexPattern } from '../../../common';
 import { FilterBar } from '../filter_bar/filter_bar';
 import { SavedQueryMeta, SaveQueryForm } from '../saved_query_form';
 import { SavedQueryManagementComponent } from '../saved_query_management';
@@ -349,6 +350,8 @@ class SearchBarUI extends Component<SearchBarProps, State> {
       />
     );
 
+    const timeRangeForSuggestionsOverride = this.props.showDatePicker ? undefined : false;
+
     let queryBar;
     if (this.shouldRenderQueryBar()) {
       queryBar = (
@@ -381,6 +384,7 @@ class SearchBarUI extends Component<SearchBarProps, State> {
           iconType={this.props.iconType}
           nonKqlMode={this.props.nonKqlMode}
           nonKqlModeHelpText={this.props.nonKqlModeHelpText}
+          timeRangeForSuggestionsOverride={timeRangeForSuggestionsOverride}
         />
       );
     }
@@ -391,6 +395,7 @@ class SearchBarUI extends Component<SearchBarProps, State> {
         // eslint-disable-next-line @typescript-eslint/naming-convention
         'globalFilterGroup__wrapper-isVisible': this.state.isFiltersVisible,
       });
+
       filterBar = (
         <div id="GlobalFilterGroup" className={filterGroupClasses}>
           <FilterBar
@@ -399,6 +404,7 @@ class SearchBarUI extends Component<SearchBarProps, State> {
             onFiltersUpdated={this.props.onFiltersUpdated}
             indexPatterns={this.props.indexPatterns!}
             appName={this.services.appName}
+            timeRangeForSuggestionsOverride={timeRangeForSuggestionsOverride}
           />
         </div>
       );
diff --git a/src/plugins/data/public/utils/table_inspector_view/components/__snapshots__/data_view.test.tsx.snap b/src/plugins/data/public/utils/table_inspector_view/components/__snapshots__/data_view.test.tsx.snap
index 1e7b59d8a9e766..612ffdcf5029ef 100644
--- a/src/plugins/data/public/utils/table_inspector_view/components/__snapshots__/data_view.test.tsx.snap
+++ b/src/plugins/data/public/utils/table_inspector_view/components/__snapshots__/data_view.test.tsx.snap
@@ -196,6 +196,7 @@ exports[`Inspector Data View component should render empty state 1`] = `
         >
           <span
             className="euiTextColor euiTextColor--subdued"
+            style={Object {}}
           >
             <EuiSpacer
               size="m"
diff --git a/src/plugins/data/public/utils/table_inspector_view/components/data_table.tsx b/src/plugins/data/public/utils/table_inspector_view/components/data_table.tsx
index 5272834012eab8..de72f163580985 100644
--- a/src/plugins/data/public/utils/table_inspector_view/components/data_table.tsx
+++ b/src/plugins/data/public/utils/table_inspector_view/components/data_table.tsx
@@ -23,7 +23,7 @@ import { i18n } from '@kbn/i18n';
 import { DataViewRow, DataViewColumn } from '../types';
 import { IUiSettingsClient } from '../../../../../../core/public';
 import { Datatable, DatatableColumn } from '../../../../../expressions/public';
-import { FieldFormatsStart } from '../../../field_formats';
+import { FieldFormatsStart } from '../../../../../field_formats/public';
 import { UiActionsStart } from '../../../../../ui_actions/public';
 
 interface DataTableFormatState {
diff --git a/src/plugins/data/public/utils/table_inspector_view/components/data_view.tsx b/src/plugins/data/public/utils/table_inspector_view/components/data_view.tsx
index 61a4daa3fc36a8..bfdd2d602de199 100644
--- a/src/plugins/data/public/utils/table_inspector_view/components/data_view.tsx
+++ b/src/plugins/data/public/utils/table_inspector_view/components/data_view.tsx
@@ -15,7 +15,7 @@ import { DataTableFormat } from './data_table';
 import { IUiSettingsClient } from '../../../../../../core/public';
 import { InspectorViewProps, Adapters } from '../../../../../inspector/public';
 import { UiActionsStart } from '../../../../../ui_actions/public';
-import { FieldFormatsStart } from '../../../field_formats';
+import { FieldFormatsStart } from '../../../../../field_formats/public';
 import { TablesAdapter, Datatable, DatatableColumn } from '../../../../../expressions/public';
 import { TableSelector } from './data_table_selector';
 import { DataDownloadOptions } from './download_options';
diff --git a/src/plugins/data/public/utils/table_inspector_view/components/data_view_wrapper.tsx b/src/plugins/data/public/utils/table_inspector_view/components/data_view_wrapper.tsx
index 4204a48925bfe3..1e0ebe3e3d9076 100644
--- a/src/plugins/data/public/utils/table_inspector_view/components/data_view_wrapper.tsx
+++ b/src/plugins/data/public/utils/table_inspector_view/components/data_view_wrapper.tsx
@@ -9,7 +9,7 @@
 import React, { lazy } from 'react';
 import { IUiSettingsClient } from 'kibana/public';
 import { UiActionsStart } from '../../../../../ui_actions/public';
-import { FieldFormatsStart } from '../../../field_formats';
+import { FieldFormatsStart } from '../../../../../field_formats/public';
 import { DatatableColumn } from '../../../../../expressions/common/expression_types/specs';
 
 const DataViewComponent = lazy(() => import('./data_view'));
diff --git a/src/plugins/data/public/utils/table_inspector_view/components/download_options.tsx b/src/plugins/data/public/utils/table_inspector_view/components/download_options.tsx
index e79a1c2b52e03d..57e586eaf12f84 100644
--- a/src/plugins/data/public/utils/table_inspector_view/components/download_options.tsx
+++ b/src/plugins/data/public/utils/table_inspector_view/components/download_options.tsx
@@ -22,7 +22,7 @@ import {
 import { CSV_MIME_TYPE, datatableToCSV, tableHasFormulas } from '../../../../common';
 import { Datatable } from '../../../../../expressions';
 import { downloadMultipleAs } from '../../../../../share/public';
-import { FieldFormatsStart } from '../../../field_formats';
+import { FieldFormatsStart } from '../../../../../field_formats/public';
 import { IUiSettingsClient } from '../../../../../../core/public';
 
 interface DataDownloadOptionsState {
diff --git a/src/plugins/data/public/utils/table_inspector_view/index.ts b/src/plugins/data/public/utils/table_inspector_view/index.ts
index 10c74bbc99dd0a..498fe8d7fcca07 100644
--- a/src/plugins/data/public/utils/table_inspector_view/index.ts
+++ b/src/plugins/data/public/utils/table_inspector_view/index.ts
@@ -11,7 +11,7 @@ import { IUiSettingsClient } from 'kibana/public';
 import { Adapters, InspectorViewDescription } from '../../../../inspector/public';
 import { getDataViewComponentWrapper } from './components/data_view_wrapper';
 import { UiActionsStart } from '../../../../ui_actions/public';
-import { FieldFormatsStart } from '../../field_formats';
+import { FieldFormatsStart } from '../../../../field_formats/public';
 import { DatatableColumn } from '../../../../expressions/common/expression_types/specs';
 
 export const getTableViewDescription = (
diff --git a/src/plugins/data/server/index.ts b/src/plugins/data/server/index.ts
index e5656ceabc1512..2e6f9492d7d483 100644
--- a/src/plugins/data/server/index.ts
+++ b/src/plugins/data/server/index.ts
@@ -11,7 +11,7 @@ import { ConfigSchema, configSchema } from '../config';
 import { DataServerPlugin, DataPluginSetup, DataPluginStart } from './plugin';
 
 export * from './deprecated';
-export { getEsQueryConfig, buildQueryFromFilters } from '../common';
+export { getEsQueryConfig } from '../common';
 
 /**
  * Exporters (CSV)
@@ -27,68 +27,16 @@ export const exporters = {
  * Field Formats:
  */
 
-import {
-  FieldFormatsRegistry,
-  FieldFormat,
-  BoolFormat,
-  BytesFormat,
-  ColorFormat,
-  DurationFormat,
-  IpFormat,
-  NumberFormat,
-  PercentFormat,
-  RelativeDateFormat,
-  SourceFormat,
-  StaticLookupFormat,
-  UrlFormat,
-  StringFormat,
-  TruncateFormat,
-  HistogramFormat,
-} from '../common/field_formats';
-
-export const fieldFormats = {
-  FieldFormatsRegistry,
-  FieldFormat,
-  BoolFormat,
-  BytesFormat,
-  ColorFormat,
-  DurationFormat,
-  IpFormat,
-  NumberFormat,
-  PercentFormat,
-  RelativeDateFormat,
-  SourceFormat,
-  StaticLookupFormat,
-  UrlFormat,
-  StringFormat,
-  TruncateFormat,
-  HistogramFormat,
-};
-
-export {
-  IFieldFormatsRegistry,
-  FieldFormatsGetConfigFn,
-  FieldFormatConfig,
-  INDEX_PATTERN_SAVED_OBJECT_TYPE,
-} from '../common';
+export { INDEX_PATTERN_SAVED_OBJECT_TYPE } from '../common';
 
 /*
  * Index patterns:
  */
 
-import { isNestedField, isFilterable } from '../common';
-
-export const indexPatterns = {
-  isFilterable,
-  isNestedField,
-};
-
 export {
   IndexPatternsFetcher,
-  FieldDescriptor as IndexPatternFieldDescriptor,
   shouldReadFieldFromDocValues, // used only in logstash_fields fixture
   FieldDescriptor,
-  mergeCapabilitiesWithFields,
   getCapabilitiesForRollupIndices,
 } from './index_patterns';
 
@@ -100,7 +48,6 @@ export {
   IndexPatternAttributes,
   UI_SETTINGS,
   IndexPattern,
-  IndexPatternLoadExpressionFunctionDefinition,
   IndexPatternsService,
   IndexPatternsService as IndexPatternsCommonService,
 } from '../common';
@@ -112,57 +59,18 @@ export {
 import {
   // aggs
   CidrMask,
-  intervalOptions,
-  isNumberType,
-  isStringType,
-  isType,
-  parentPipelineType,
-  propFilter,
-  siblingPipelineType,
-  termsAggFilter,
   dateHistogramInterval,
-  InvalidEsCalendarIntervalError,
-  InvalidEsIntervalFormatError,
   IpAddress,
-  isValidEsInterval,
-  isValidInterval,
-  parseEsInterval,
   parseInterval,
-  toAbsoluteDates,
   // tabify
-  tabifyAggResponse,
-  tabifyGetColumns,
   calcAutoIntervalLessThan,
 } from '../common';
 import { autocompleteConfigDeprecationProvider } from './config_deprecations';
 
 export {
   // aggs
-  AggGroupLabels,
-  AggGroupName,
-  AggGroupNames,
-  AggFunctionsMapping,
-  AggParam,
-  AggParamOption,
-  AggParamType,
-  AggConfigOptions,
-  BUCKET_TYPES,
-  EsaggsExpressionFunctionDefinition,
-  IAggConfig,
-  IAggConfigs,
-  IAggType,
-  IFieldParamType,
-  IMetricAggType,
   METRIC_TYPES,
-  OptionedParamType,
-  OptionedValueProp,
   ParsedInterval,
-  // expressions
-  ExecutionContextSearch,
-  ExpressionFunctionKibana,
-  ExpressionFunctionKibanaContext,
-  ExpressionValueSearchContext,
-  KibanaContext,
   // search
   ISearchOptions,
   IEsSearchRequest,
@@ -173,23 +81,12 @@ export {
 export {
   IScopedSearchClient,
   ISearchStrategy,
-  ISearchSetup,
-  ISearchStart,
   SearchStrategyDependencies,
-  getDefaultSearchParams,
-  getShardTimeout,
-  getTotalLoaded,
-  toKibanaSearchResponse,
   shimHitsTotal,
-  usageProvider,
-  searchUsageObserver,
-  shimAbortSignal,
-  SearchUsage,
   SearchSessionService,
   ISearchSessionService,
   SearchRequestHandlerContext,
   DataRequestHandlerContext,
-  AsyncSearchResponse,
   AsyncSearchStatusResponse,
   NoSearchIdInSessionError,
 } from './search';
@@ -199,26 +96,10 @@ export const search = {
   aggs: {
     CidrMask,
     dateHistogramInterval,
-    intervalOptions,
-    InvalidEsCalendarIntervalError,
-    InvalidEsIntervalFormatError,
     IpAddress,
-    isNumberType,
-    isStringType,
-    isType,
-    isValidEsInterval,
-    isValidInterval,
-    parentPipelineType,
-    parseEsInterval,
     parseInterval,
-    propFilter,
-    siblingPipelineType,
-    termsAggFilter,
-    toAbsoluteDates,
     calcAutoIntervalLessThan,
   },
-  tabifyAggResponse,
-  tabifyGetColumns,
 };
 
 /**
@@ -227,11 +108,9 @@ export const search = {
  */
 
 export {
-  // kbn field types
   castEsToKbnFieldTypeName,
   getTime,
   // timefilter
-  RefreshInterval,
   TimeRange,
   // utils
   parseInterval,
@@ -260,5 +139,3 @@ export const config: PluginConfigDescriptor<ConfigSchema> = {
   },
   schema: configSchema,
 };
-
-export type { IndexPatternsServiceProvider } from './index_patterns';
diff --git a/src/plugins/data/server/index_patterns/index_patterns_service.ts b/src/plugins/data/server/index_patterns/index_patterns_service.ts
index 4269f15127daf3..c3cdc65d3fa040 100644
--- a/src/plugins/data/server/index_patterns/index_patterns_service.ts
+++ b/src/plugins/data/server/index_patterns/index_patterns_service.ts
@@ -22,7 +22,7 @@ import { registerRoutes } from './routes';
 import { indexPatternSavedObjectType } from '../saved_objects';
 import { capabilitiesProvider } from './capabilities_provider';
 import { IndexPatternsCommonService } from '../';
-import { FieldFormatsStart } from '../field_formats';
+import { FieldFormatsStart } from '../../../field_formats/server';
 import { getIndexPatternLoad } from './expressions';
 import { UiSettingsServerToCommon } from './ui_settings_wrapper';
 import { IndexPatternsApiServer } from './index_patterns_api_client';
diff --git a/src/plugins/data/server/mocks.ts b/src/plugins/data/server/mocks.ts
index 786dd30dbabd0b..af104dea72af79 100644
--- a/src/plugins/data/server/mocks.ts
+++ b/src/plugins/data/server/mocks.ts
@@ -11,13 +11,19 @@ import {
   createSearchStartMock,
   createSearchRequestHandlerContext,
 } from './search/mocks';
-import { createFieldFormatsSetupMock, createFieldFormatsStartMock } from './field_formats/mocks';
+import {
+  createFieldFormatsSetupMock,
+  createFieldFormatsStartMock,
+} from '../../field_formats/server/mocks';
 import { createIndexPatternsStartMock } from './index_patterns/mocks';
 import { DataRequestHandlerContext } from './search';
 
 function createSetupContract() {
   return {
     search: createSearchSetupMock(),
+    /**
+     * @deprecated - use directly from "fieldFormats" plugin instead
+     */
     fieldFormats: createFieldFormatsSetupMock(),
   };
 }
@@ -25,6 +31,9 @@ function createSetupContract() {
 function createStartContract() {
   return {
     search: createSearchStartMock(),
+    /**
+     * @deprecated - use directly from "fieldFormats" plugin instead
+     */
     fieldFormats: createFieldFormatsStartMock(),
     indexPatterns: createIndexPatternsStartMock(),
   };
diff --git a/src/plugins/data/server/plugin.ts b/src/plugins/data/server/plugin.ts
index 7b73802f1a34d1..e04095ed26a46b 100644
--- a/src/plugins/data/server/plugin.ts
+++ b/src/plugins/data/server/plugin.ts
@@ -18,7 +18,7 @@ import { ScriptsService } from './scripts';
 import { KqlTelemetryService } from './kql_telemetry';
 import { UsageCollectionSetup } from '../../usage_collection/server';
 import { AutocompleteService } from './autocomplete';
-import { FieldFormatsService, FieldFormatsSetup, FieldFormatsStart } from './field_formats';
+import { FieldFormatsSetup, FieldFormatsStart } from '../../field_formats/server';
 import { getUiSettings } from './ui_settings';
 
 export interface DataEnhancements {
@@ -27,6 +27,9 @@ export interface DataEnhancements {
 
 export interface DataPluginSetup {
   search: ISearchSetup;
+  /**
+   * @deprecated - use "fieldFormats" plugin directly instead
+   */
   fieldFormats: FieldFormatsSetup;
   /**
    * @internal
@@ -36,6 +39,9 @@ export interface DataPluginSetup {
 
 export interface DataPluginStart {
   search: ISearchStart;
+  /**
+   * @deprecated - use "fieldFormats" plugin directly instead
+   */
   fieldFormats: FieldFormatsStart;
   indexPatterns: IndexPatternsServiceStart;
 }
@@ -44,6 +50,7 @@ export interface DataPluginSetupDependencies {
   bfetch: BfetchServerSetup;
   expressions: ExpressionsServerSetup;
   usageCollection?: UsageCollectionSetup;
+  fieldFormats: FieldFormatsSetup;
 }
 
 export interface DataPluginStartDependencies {
@@ -64,7 +71,6 @@ export class DataServerPlugin
   private readonly kqlTelemetryService: KqlTelemetryService;
   private readonly autocompleteService: AutocompleteService;
   private readonly indexPatterns = new IndexPatternsServiceProvider();
-  private readonly fieldFormats = new FieldFormatsService();
   private readonly queryService = new QueryService();
   private readonly logger: Logger;
 
@@ -78,7 +84,7 @@ export class DataServerPlugin
 
   public setup(
     core: CoreSetup<DataPluginStartDependencies, DataPluginStart>,
-    { bfetch, expressions, usageCollection }: DataPluginSetupDependencies
+    { bfetch, expressions, usageCollection, fieldFormats }: DataPluginSetupDependencies
   ) {
     this.scriptsService.setup(core);
     this.queryService.setup(core);
@@ -103,12 +109,11 @@ export class DataServerPlugin
         searchSetup.__enhance(enhancements.search);
       },
       search: searchSetup,
-      fieldFormats: this.fieldFormats.setup(),
+      fieldFormats,
     };
   }
 
-  public start(core: CoreStart) {
-    const fieldFormats = this.fieldFormats.start();
+  public start(core: CoreStart, { fieldFormats }: DataPluginStartDependencies) {
     const indexPatterns = this.indexPatterns.start(core, {
       fieldFormats,
       logger: this.logger.get('indexPatterns'),
diff --git a/src/plugins/data/server/search/aggs/aggs_service.test.ts b/src/plugins/data/server/search/aggs/aggs_service.test.ts
index 0a4f54ee339a17..fdff2a4a8118ca 100644
--- a/src/plugins/data/server/search/aggs/aggs_service.test.ts
+++ b/src/plugins/data/server/search/aggs/aggs_service.test.ts
@@ -11,7 +11,7 @@ import { KibanaRequest, ElasticsearchClient } from 'src/core/server';
 import { coreMock } from '../../../../../core/server/mocks';
 import { expressionsPluginMock } from '../../../../../plugins/expressions/server/mocks';
 import { BucketAggType, getAggTypes, MetricAggType } from '../../../common';
-import { createFieldFormatsStartMock } from '../../field_formats/mocks';
+import { createFieldFormatsStartMock } from '../../../../field_formats/server/mocks';
 import { createIndexPatternsStartMock } from '../../index_patterns/mocks';
 
 import { AggsService, AggsSetupDependencies, AggsStartDependencies } from './aggs_service';
diff --git a/src/plugins/data/server/search/aggs/aggs_service.ts b/src/plugins/data/server/search/aggs/aggs_service.ts
index 96927728f2f2f5..197d8fd7caa990 100644
--- a/src/plugins/data/server/search/aggs/aggs_service.ts
+++ b/src/plugins/data/server/search/aggs/aggs_service.ts
@@ -22,7 +22,7 @@ import {
   calculateBounds,
   TimeRange,
 } from '../../../common';
-import { FieldFormatsStart } from '../../field_formats';
+import { FieldFormatsStart } from '../../../../field_formats/server';
 import { IndexPatternsServiceStart } from '../../index_patterns';
 import { AggsSetup, AggsStart } from './types';
 
diff --git a/src/plugins/data/server/search/search_service.test.ts b/src/plugins/data/server/search/search_service.test.ts
index 314cb2c3acbf87..e6db3c76ef9ba8 100644
--- a/src/plugins/data/server/search/search_service.test.ts
+++ b/src/plugins/data/server/search/search_service.test.ts
@@ -11,7 +11,7 @@ import { CoreSetup, CoreStart, SavedObject } from '../../../../core/server';
 import { coreMock } from '../../../../core/server/mocks';
 
 import { DataPluginStart, DataPluginStartDependencies } from '../plugin';
-import { createFieldFormatsStartMock } from '../field_formats/mocks';
+import { createFieldFormatsStartMock } from '../../../field_formats/server/mocks';
 import { createIndexPatternsStartMock } from '../index_patterns/mocks';
 
 import { SearchService, SearchServiceSetupDependencies } from './search_service';
diff --git a/src/plugins/data/server/search/search_service.ts b/src/plugins/data/server/search/search_service.ts
index cc7981220fa6ff..5b4ff121f3c77c 100644
--- a/src/plugins/data/server/search/search_service.ts
+++ b/src/plugins/data/server/search/search_service.ts
@@ -34,7 +34,7 @@ import type {
 
 import { AggsService } from './aggs';
 
-import { FieldFormatsStart } from '../field_formats';
+import { FieldFormatsStart } from '../../../field_formats/server';
 import { IndexPatternsServiceStart } from '../index_patterns';
 import { registerMsearchRoute, registerSearchRoute } from './routes';
 import { ES_SEARCH_STRATEGY, esSearchStrategyProvider } from './strategies/es_search';
diff --git a/src/plugins/data/server/server.api.md b/src/plugins/data/server/server.api.md
index 9d5e598588f25b..761d6f9345b072 100644
--- a/src/plugins/data/server/server.api.md
+++ b/src/plugins/data/server/server.api.md
@@ -4,17 +4,13 @@
 
 ```ts
 
-import { $Values } from '@kbn/utility-types';
-import { Adapters } from 'src/plugins/inspector/common';
 import { Assign } from '@kbn/utility-types';
 import { BfetchServerSetup } from 'src/plugins/bfetch/server';
 import { ConfigDeprecationProvider } from '@kbn/config';
 import { CoreSetup } from 'src/core/server';
-import { CoreSetup as CoreSetup_2 } from 'kibana/server';
 import { CoreStart } from 'kibana/server';
 import { CoreStart as CoreStart_2 } from 'src/core/server';
 import { Datatable } from 'src/plugins/expressions';
-import { Datatable as Datatable_2 } from 'src/plugins/expressions/common';
 import { DatatableColumn } from 'src/plugins/expressions';
 import { DatatableColumnType } from 'src/plugins/expressions/common';
 import { Duration } from 'moment';
@@ -27,13 +23,9 @@ import { ES_FIELD_TYPES } from '@kbn/field-types';
 import { EsQueryConfig as EsQueryConfig_2 } from '@kbn/es-query';
 import { estypes } from '@elastic/elasticsearch';
 import { EventEmitter } from 'events';
-import { ExecutionContext } from 'src/plugins/expressions/common';
 import { ExpressionAstExpression } from 'src/plugins/expressions/common';
-import { ExpressionFunctionDefinition } from 'src/plugins/expressions/common';
 import { ExpressionsServerSetup } from 'src/plugins/expressions/server';
-import { ExpressionValueBoxed } from 'src/plugins/expressions/common';
 import { Filter as Filter_2 } from '@kbn/es-query';
-import { FormatFactory as FormatFactory_2 } from 'src/plugins/data/common/field_formats/utils';
 import { IAggConfigs as IAggConfigs_2 } from 'src/plugins/data/public';
 import { IEsSearchResponse as IEsSearchResponse_2 } from 'src/plugins/data/public';
 import { IFieldSubType as IFieldSubType_2 } from '@kbn/es-query';
@@ -43,14 +35,12 @@ import { IScopedClusterClient } from 'src/core/server';
 import { ISearchOptions as ISearchOptions_2 } from 'src/plugins/data/public';
 import { ISearchSource } from 'src/plugins/data/public';
 import { IUiSettingsClient } from 'src/core/server';
-import { IUiSettingsClient as IUiSettingsClient_3 } from 'kibana/server';
 import { KBN_FIELD_TYPES } from '@kbn/field-types';
 import { KibanaExecutionContext } from 'src/core/public';
 import { KibanaRequest } from 'src/core/server';
 import { KibanaRequest as KibanaRequest_2 } from 'kibana/server';
 import { KueryNode as KueryNode_2 } from '@kbn/es-query';
 import { Logger } from 'src/core/server';
-import { Logger as Logger_2 } from 'kibana/server';
 import { LoggerFactory } from '@kbn/logging';
 import { Moment } from 'moment';
 import moment from 'moment';
@@ -58,9 +48,7 @@ import { Observable } from 'rxjs';
 import { PackageInfo } from '@kbn/config';
 import { PathConfigType } from '@kbn/utils';
 import { Plugin as Plugin_2 } from 'src/core/server';
-import { Plugin as Plugin_3 } from 'kibana/server';
 import { PluginInitializerContext as PluginInitializerContext_2 } from 'src/core/server';
-import { PublicMethodsOf } from '@kbn/utility-types';
 import { Query } from '@kbn/es-query';
 import { RecursiveReadonly } from '@kbn/utility-types';
 import { RequestAdapter } from 'src/plugins/inspector/common';
@@ -72,239 +60,14 @@ import { SavedObjectsClientContract as SavedObjectsClientContract_2 } from 'kiba
 import { SavedObjectsFindOptions } from 'kibana/server';
 import { SavedObjectsFindResponse } from 'kibana/server';
 import { SavedObjectsUpdateResponse } from 'kibana/server';
-import { Search } from '@elastic/elasticsearch/api/requestParams';
-import { SerializedFieldFormat as SerializedFieldFormat_2 } from 'src/plugins/expressions/common';
-import { SharedGlobalConfig as SharedGlobalConfig_2 } from 'kibana/server';
+import { SerializedFieldFormat as SerializedFieldFormat_3 } from 'src/plugins/expressions/common';
 import { ToastInputFields } from 'src/core/public/notifications';
-import { TransportRequestPromise } from '@elastic/elasticsearch/lib/Transport';
 import { Type } from '@kbn/config-schema';
 import { TypeOf } from '@kbn/config-schema';
 import { UiCounterMetricType } from '@kbn/analytics';
 import { Unit } from '@elastic/datemath';
-import { UsageCollectionSetup as UsageCollectionSetup_2 } from 'src/plugins/usage_collection/server';
-
-// Warning: (ae-forgotten-export) The symbol "AggConfigSerialized" needs to be exported by the entry point index.d.ts
-// Warning: (ae-missing-release-tag) "AggConfigOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type AggConfigOptions = Assign<AggConfigSerialized, {
-    type: IAggType;
-}>;
-
-// Warning: (ae-missing-release-tag) "AggFunctionsMapping" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public
-export interface AggFunctionsMapping {
-    // Warning: (ae-forgotten-export) The symbol "aggAvg" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggAvg: ReturnType<typeof aggAvg>;
-    // Warning: (ae-forgotten-export) The symbol "aggBucketAvg" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggBucketAvg: ReturnType<typeof aggBucketAvg>;
-    // Warning: (ae-forgotten-export) The symbol "aggBucketMax" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggBucketMax: ReturnType<typeof aggBucketMax>;
-    // Warning: (ae-forgotten-export) The symbol "aggBucketMin" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggBucketMin: ReturnType<typeof aggBucketMin>;
-    // Warning: (ae-forgotten-export) The symbol "aggBucketSum" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggBucketSum: ReturnType<typeof aggBucketSum>;
-    // Warning: (ae-forgotten-export) The symbol "aggCardinality" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggCardinality: ReturnType<typeof aggCardinality>;
-    // Warning: (ae-forgotten-export) The symbol "aggCount" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggCount: ReturnType<typeof aggCount>;
-    // Warning: (ae-forgotten-export) The symbol "aggCumulativeSum" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggCumulativeSum: ReturnType<typeof aggCumulativeSum>;
-    // Warning: (ae-forgotten-export) The symbol "aggDateHistogram" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggDateHistogram: ReturnType<typeof aggDateHistogram>;
-    // Warning: (ae-forgotten-export) The symbol "aggDateRange" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggDateRange: ReturnType<typeof aggDateRange>;
-    // Warning: (ae-forgotten-export) The symbol "aggDerivative" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggDerivative: ReturnType<typeof aggDerivative>;
-    // Warning: (ae-forgotten-export) The symbol "aggFilter" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggFilter: ReturnType<typeof aggFilter>;
-    // Warning: (ae-forgotten-export) The symbol "aggFilteredMetric" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggFilteredMetric: ReturnType<typeof aggFilteredMetric>;
-    // Warning: (ae-forgotten-export) The symbol "aggFilters" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggFilters: ReturnType<typeof aggFilters>;
-    // Warning: (ae-forgotten-export) The symbol "aggGeoBounds" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggGeoBounds: ReturnType<typeof aggGeoBounds>;
-    // Warning: (ae-forgotten-export) The symbol "aggGeoCentroid" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggGeoCentroid: ReturnType<typeof aggGeoCentroid>;
-    // Warning: (ae-forgotten-export) The symbol "aggGeoHash" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggGeoHash: ReturnType<typeof aggGeoHash>;
-    // Warning: (ae-forgotten-export) The symbol "aggGeoTile" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggGeoTile: ReturnType<typeof aggGeoTile>;
-    // Warning: (ae-forgotten-export) The symbol "aggHistogram" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggHistogram: ReturnType<typeof aggHistogram>;
-    // Warning: (ae-forgotten-export) The symbol "aggIpRange" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggIpRange: ReturnType<typeof aggIpRange>;
-    // Warning: (ae-forgotten-export) The symbol "aggMax" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggMax: ReturnType<typeof aggMax>;
-    // Warning: (ae-forgotten-export) The symbol "aggMedian" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggMedian: ReturnType<typeof aggMedian>;
-    // Warning: (ae-forgotten-export) The symbol "aggMin" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggMin: ReturnType<typeof aggMin>;
-    // Warning: (ae-forgotten-export) The symbol "aggMovingAvg" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggMovingAvg: ReturnType<typeof aggMovingAvg>;
-    // Warning: (ae-forgotten-export) The symbol "aggPercentileRanks" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggPercentileRanks: ReturnType<typeof aggPercentileRanks>;
-    // Warning: (ae-forgotten-export) The symbol "aggPercentiles" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggPercentiles: ReturnType<typeof aggPercentiles>;
-    // Warning: (ae-forgotten-export) The symbol "aggRange" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggRange: ReturnType<typeof aggRange>;
-    // Warning: (ae-forgotten-export) The symbol "aggSerialDiff" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggSerialDiff: ReturnType<typeof aggSerialDiff>;
-    // Warning: (ae-forgotten-export) The symbol "aggSignificantTerms" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggSignificantTerms: ReturnType<typeof aggSignificantTerms>;
-    // Warning: (ae-forgotten-export) The symbol "aggSinglePercentile" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggSinglePercentile: ReturnType<typeof aggSinglePercentile>;
-    // Warning: (ae-forgotten-export) The symbol "aggStdDeviation" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggStdDeviation: ReturnType<typeof aggStdDeviation>;
-    // Warning: (ae-forgotten-export) The symbol "aggSum" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggSum: ReturnType<typeof aggSum>;
-    // Warning: (ae-forgotten-export) The symbol "aggTerms" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggTerms: ReturnType<typeof aggTerms>;
-    // Warning: (ae-forgotten-export) The symbol "aggTopHit" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggTopHit: ReturnType<typeof aggTopHit>;
-}
-
-// Warning: (ae-missing-release-tag) "AggGroupLabels" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export const AggGroupLabels: {
-    buckets: string;
-    metrics: string;
-    none: string;
-};
-
-// Warning: (ae-missing-release-tag) "AggGroupName" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type AggGroupName = $Values<typeof AggGroupNames>;
-
-// Warning: (ae-missing-release-tag) "AggGroupNames" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export const AggGroupNames: Readonly<{
-    Buckets: "buckets";
-    Metrics: "metrics";
-    None: "none";
-}>;
-
-// Warning: (ae-forgotten-export) The symbol "BaseParamType" needs to be exported by the entry point index.d.ts
-// Warning: (ae-missing-release-tag) "AggParam" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type AggParam = BaseParamType;
-
-// Warning: (ae-missing-release-tag) "AggParamOption" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export interface AggParamOption {
-    // (undocumented)
-    display: string;
-    // Warning: (ae-forgotten-export) The symbol "AggConfig" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    enabled?(agg: AggConfig): boolean;
-    // (undocumented)
-    val: string;
-}
-
-// Warning: (ae-missing-release-tag) "AggParamType" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export class AggParamType<TAggConfig extends IAggConfig = IAggConfig> extends BaseParamType<TAggConfig> {
-    constructor(config: Record<string, any>);
-    // (undocumented)
-    allowedAggs: string[];
-    // (undocumented)
-    makeAgg: (agg: TAggConfig, state?: AggConfigSerialized) => TAggConfig;
-}
-
-// Warning: (ae-missing-release-tag) "AsyncSearchResponse" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export interface AsyncSearchResponse<T = unknown> {
-    // (undocumented)
-    expiration_time_in_millis: number;
-    // (undocumented)
-    id?: string;
-    // (undocumented)
-    is_partial: boolean;
-    // (undocumented)
-    is_running: boolean;
-    // (undocumented)
-    response: estypes.SearchResponse<T>;
-    // (undocumented)
-    start_time_in_millis: number;
-}
 
+// Warning: (ae-forgotten-export) The symbol "AsyncSearchResponse" needs to be exported by the entry point index.d.ts
 // Warning: (ae-missing-release-tag) "AsyncSearchStatusResponse" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -315,44 +78,6 @@ export interface AsyncSearchStatusResponse extends Omit<AsyncSearchResponse, 're
     _shards: estypes.ShardStatistics;
 }
 
-// Warning: (ae-missing-release-tag) "BUCKET_TYPES" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export enum BUCKET_TYPES {
-    // (undocumented)
-    DATE_HISTOGRAM = "date_histogram",
-    // (undocumented)
-    DATE_RANGE = "date_range",
-    // (undocumented)
-    FILTER = "filter",
-    // (undocumented)
-    FILTERS = "filters",
-    // (undocumented)
-    GEOHASH_GRID = "geohash_grid",
-    // (undocumented)
-    GEOTILE_GRID = "geotile_grid",
-    // (undocumented)
-    HISTOGRAM = "histogram",
-    // (undocumented)
-    IP_RANGE = "ip_range",
-    // (undocumented)
-    RANGE = "range",
-    // (undocumented)
-    SIGNIFICANT_TERMS = "significant_terms",
-    // (undocumented)
-    TERMS = "terms"
-}
-
-// Warning: (ae-missing-release-tag) "buildQueryFromFilters" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public @deprecated (undocumented)
-export const buildQueryFromFilters: (filters: Filter_2[] | undefined, indexPattern: import("@kbn/es-query").IndexPatternBase | undefined, ignoreFilterIfFieldNotInIndex?: boolean | undefined) => {
-    must: never[];
-    filter: Filter_2[];
-    should: never[];
-    must_not: Filter_2[];
-};
-
 // Warning: (ae-missing-release-tag) "castEsToKbnFieldTypeName" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public @deprecated (undocumented)
@@ -378,14 +103,6 @@ export { ES_FIELD_TYPES }
 // @public (undocumented)
 export const ES_SEARCH_STRATEGY = "es";
 
-// Warning: (ae-forgotten-export) The symbol "Input" needs to be exported by the entry point index.d.ts
-// Warning: (ae-forgotten-export) The symbol "Arguments" needs to be exported by the entry point index.d.ts
-// Warning: (ae-forgotten-export) The symbol "Output" needs to be exported by the entry point index.d.ts
-// Warning: (ae-missing-release-tag) "EsaggsExpressionFunctionDefinition" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type EsaggsExpressionFunctionDefinition = ExpressionFunctionDefinition<'esaggs', Input_36, Arguments_21, Output_36>;
-
 // Warning: (ae-missing-release-tag) "esFilters" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -429,15 +146,6 @@ export const esQuery: {
 // @public @deprecated (undocumented)
 export type EsQueryConfig = EsQueryConfig_2;
 
-// Warning: (ae-missing-release-tag) "ExecutionContextSearch" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type ExecutionContextSearch = {
-    filters?: Filter[];
-    query?: Query | Query[];
-    timeRange?: TimeRange;
-};
-
 // Warning: (ae-missing-release-tag) "exporters" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -446,26 +154,10 @@ export const exporters: {
     CSV_MIME_TYPE: string;
 };
 
-// Warning: (ae-missing-release-tag) "ExpressionFunctionKibana" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type ExpressionFunctionKibana = ExpressionFunctionDefinition<'kibana', ExpressionValueSearchContext | null, object, ExpressionValueSearchContext, ExecutionContext<Adapters, ExecutionContextSearch>>;
-
-// Warning: (ae-forgotten-export) The symbol "Arguments" needs to be exported by the entry point index.d.ts
-// Warning: (ae-missing-release-tag) "ExpressionFunctionKibanaContext" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type ExpressionFunctionKibanaContext = ExpressionFunctionDefinition<'kibana_context', KibanaContext | null, Arguments_22, Promise<KibanaContext>, ExecutionContext<Adapters, ExecutionContextSearch>>;
-
-// Warning: (ae-missing-release-tag) "ExpressionValueSearchContext" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type ExpressionValueSearchContext = ExpressionValueBoxed<'kibana_context', ExecutionContextSearch>;
-
 // Warning: (ae-missing-release-tag) "FieldDescriptor" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
-interface FieldDescriptor {
+export interface FieldDescriptor {
     // (undocumented)
     aggregatable: boolean;
     // (undocumented)
@@ -484,52 +176,6 @@ interface FieldDescriptor {
     type: string;
 }
 
-export { FieldDescriptor }
-
-export { FieldDescriptor as IndexPatternFieldDescriptor }
-
-// Warning: (ae-missing-release-tag) "FieldFormatConfig" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export interface FieldFormatConfig {
-    // (undocumented)
-    es?: boolean;
-    // Warning: (ae-forgotten-export) The symbol "FieldFormatId" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    id: FieldFormatId;
-    // (undocumented)
-    params: Record<string, any>;
-}
-
-// Warning: (ae-missing-release-tag) "fieldFormats" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export const fieldFormats: {
-    FieldFormatsRegistry: typeof FieldFormatsRegistry;
-    FieldFormat: typeof FieldFormat;
-    BoolFormat: typeof BoolFormat;
-    BytesFormat: typeof BytesFormat;
-    ColorFormat: typeof ColorFormat;
-    DurationFormat: typeof DurationFormat;
-    IpFormat: typeof IpFormat;
-    NumberFormat: typeof NumberFormat;
-    PercentFormat: typeof PercentFormat;
-    RelativeDateFormat: typeof RelativeDateFormat;
-    SourceFormat: typeof SourceFormat;
-    StaticLookupFormat: typeof StaticLookupFormat;
-    UrlFormat: typeof UrlFormat;
-    StringFormat: typeof StringFormat;
-    TruncateFormat: typeof TruncateFormat;
-    HistogramFormat: typeof HistogramFormat;
-};
-
-// Warning: (ae-forgotten-export) The symbol "GetConfigFn" needs to be exported by the entry point index.d.ts
-// Warning: (ae-missing-release-tag) "FieldFormatsGetConfigFn" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type FieldFormatsGetConfigFn = GetConfigFn;
-
 // Warning: (ae-missing-release-tag) "Filter" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public @deprecated (undocumented)
@@ -544,22 +190,12 @@ export function getCapabilitiesForRollupIndices(indices: Record<string, {
     [key: string]: any;
 };
 
-// Warning: (ae-missing-release-tag) "getDefaultSearchParams" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export function getDefaultSearchParams(uiSettingsClient: IUiSettingsClient_3): Promise<Pick<Search, 'max_concurrent_shard_requests' | 'ignore_unavailable' | 'track_total_hits'>>;
-
 // Warning: (ae-forgotten-export) The symbol "KibanaConfig" needs to be exported by the entry point index.d.ts
 // Warning: (ae-missing-release-tag) "getEsQueryConfig" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
 export function getEsQueryConfig(config: KibanaConfig): EsQueryConfig_2;
 
-// Warning: (ae-missing-release-tag) "getShardTimeout" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export function getShardTimeout(config: SharedGlobalConfig_2): Pick<Search, 'timeout'>;
-
 // Warning: (ae-forgotten-export) The symbol "IIndexPattern" needs to be exported by the entry point index.d.ts
 // Warning: (ae-missing-release-tag) "getTime" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
@@ -569,28 +205,6 @@ export function getTime(indexPattern: IIndexPattern | undefined, timeRange: Time
     fieldName?: string;
 }): import("@kbn/es-query").RangeFilter | undefined;
 
-// @internal
-export function getTotalLoaded(response: estypes.SearchResponse<unknown>): {
-    total: number;
-    loaded: number;
-};
-
-// Warning: (ae-missing-release-tag) "IAggConfig" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public
-export type IAggConfig = AggConfig;
-
-// Warning: (ae-forgotten-export) The symbol "AggConfigs" needs to be exported by the entry point index.d.ts
-//
-// @internal
-export type IAggConfigs = AggConfigs;
-
-// Warning: (ae-forgotten-export) The symbol "AggType" needs to be exported by the entry point index.d.ts
-// Warning: (ae-missing-release-tag) "IAggType" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type IAggType = AggType;
-
 // Warning: (ae-forgotten-export) The symbol "IKibanaSearchRequest" needs to be exported by the entry point index.d.ts
 // Warning: (ae-forgotten-export) The symbol "ISearchRequestParams" needs to be exported by the entry point index.d.ts
 // Warning: (ae-missing-release-tag) "IEsSearchRequest" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
@@ -607,17 +221,6 @@ export interface IEsSearchRequest extends IKibanaSearchRequest<ISearchRequestPar
 // @public (undocumented)
 export type IEsSearchResponse<Source = any> = IKibanaSearchResponse<estypes.SearchResponse<Source>>;
 
-// Warning: (ae-missing-release-tag) "IFieldFormatsRegistry" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type IFieldFormatsRegistry = PublicMethodsOf<FieldFormatsRegistry>;
-
-// Warning: (ae-forgotten-export) The symbol "FieldParamType" needs to be exported by the entry point index.d.ts
-// Warning: (ae-missing-release-tag) "IFieldParamType" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type IFieldParamType = FieldParamType;
-
 // Warning: (ae-missing-release-tag) "IFieldSubType" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public @deprecated (undocumented)
@@ -657,12 +260,6 @@ export interface IFieldType extends IndexPatternFieldBase {
     visualizable?: boolean;
 }
 
-// Warning: (ae-forgotten-export) The symbol "MetricAggType" needs to be exported by the entry point index.d.ts
-// Warning: (ae-missing-release-tag) "IMetricAggType" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type IMetricAggType = MetricAggType;
-
 // @public (undocumented)
 export const INDEX_PATTERN_SAVED_OBJECT_TYPE = "index-pattern";
 
@@ -721,6 +318,7 @@ export class IndexPattern implements IIndexPattern {
     };
     // (undocumented)
     getFieldByName(name: string): IndexPatternField | undefined;
+    // Warning: (ae-forgotten-export) The symbol "FieldFormat" needs to be exported by the entry point index.d.ts
     getFormatterForField(field: IndexPatternField | IndexPatternField['spec'] | IFieldType): FieldFormat;
     getFormatterForFieldNoDefault(fieldname: string): FieldFormat | undefined;
     // @deprecated (undocumented)
@@ -769,7 +367,7 @@ export class IndexPattern implements IIndexPattern {
     // Warning: (ae-forgotten-export) The symbol "SerializedFieldFormat" needs to be exported by the entry point index.d.ts
     //
     // (undocumented)
-    readonly setFieldFormat: (fieldName: string, format: SerializedFieldFormat) => void;
+    readonly setFieldFormat: (fieldName: string, format: SerializedFieldFormat_2) => void;
     // Warning: (ae-forgotten-export) The symbol "SourceFilter" needs to be exported by the entry point index.d.ts
     //
     // (undocumented)
@@ -881,23 +479,6 @@ export class IndexPatternField implements IFieldType {
     get visualizable(): boolean;
 }
 
-// Warning: (ae-forgotten-export) The symbol "name" needs to be exported by the entry point index.d.ts
-// Warning: (ae-forgotten-export) The symbol "Input" needs to be exported by the entry point index.d.ts
-// Warning: (ae-forgotten-export) The symbol "Arguments" needs to be exported by the entry point index.d.ts
-// Warning: (ae-forgotten-export) The symbol "Output" needs to be exported by the entry point index.d.ts
-// Warning: (ae-missing-release-tag) "IndexPatternLoadExpressionFunctionDefinition" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type IndexPatternLoadExpressionFunctionDefinition = ExpressionFunctionDefinition<typeof name, Input, Arguments, Output>;
-
-// Warning: (ae-missing-release-tag) "indexPatterns" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export const indexPatterns: {
-    isFilterable: typeof isFilterable;
-    isNestedField: typeof isNestedField;
-};
-
 // Warning: (ae-missing-release-tag) "IndexPatternsFetcher" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -965,22 +546,6 @@ export { IndexPatternsService as IndexPatternsCommonService }
 
 export { IndexPatternsService }
 
-// Warning: (ae-forgotten-export) The symbol "IndexPatternsServiceStart" needs to be exported by the entry point index.d.ts
-// Warning: (ae-missing-release-tag) "IndexPatternsServiceProvider" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export class IndexPatternsServiceProvider implements Plugin_3<void, IndexPatternsServiceStart> {
-    // Warning: (ae-forgotten-export) The symbol "IndexPatternsServiceStartDeps" needs to be exported by the entry point index.d.ts
-    // Warning: (ae-forgotten-export) The symbol "IndexPatternsServiceSetupDeps" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    setup(core: CoreSetup_2<IndexPatternsServiceStartDeps, PluginStart>, { expressions, usageCollection }: IndexPatternsServiceSetupDeps): void;
-    // (undocumented)
-    start(core: CoreStart, { fieldFormats, logger }: IndexPatternsServiceStartDeps): {
-        indexPatternsServiceFactory: (savedObjectsClient: Pick<import("../../../../core/server").SavedObjectsClient, "update" | "get" | "delete" | "create" | "bulkCreate" | "checkConflicts" | "find" | "bulkGet" | "resolve" | "collectMultiNamespaceReferences" | "updateObjectsSpaces" | "bulkUpdate" | "removeReferencesTo" | "openPointInTimeForType" | "closePointInTime" | "createPointInTimeFinder" | "errors">, elasticsearchClient: ElasticsearchClient_2) => Promise<IndexPatternsService>;
-    };
-}
-
 // Warning: (ae-forgotten-export) The symbol "ISearchClient" needs to be exported by the entry point index.d.ts
 // Warning: (ae-missing-release-tag) "IScopedSearchClient" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
@@ -1029,40 +594,6 @@ export interface ISearchSessionService<T = unknown> {
     asScopedProvider: (core: CoreStart) => (request: KibanaRequest_2) => IScopedSearchSessionsClient<T>;
 }
 
-// Warning: (ae-missing-release-tag) "ISearchSetup" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export interface ISearchSetup {
-    // Warning: (ae-forgotten-export) The symbol "SearchEnhancements" needs to be exported by the entry point index.d.ts
-    //
-    // @internal (undocumented)
-    __enhance: (enhancements: SearchEnhancements) => void;
-    // Warning: (ae-forgotten-export) The symbol "AggsSetup" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggs: AggsSetup;
-    registerSearchStrategy: <SearchStrategyRequest extends IKibanaSearchRequest = IEsSearchRequest, SearchStrategyResponse extends IKibanaSearchResponse = IEsSearchResponse>(name: string, strategy: ISearchStrategy<SearchStrategyRequest, SearchStrategyResponse>) => void;
-    usage?: SearchUsage;
-}
-
-// Warning: (ae-missing-release-tag) "ISearchStart" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export interface ISearchStart<SearchStrategyRequest extends IKibanaSearchRequest = IEsSearchRequest, SearchStrategyResponse extends IKibanaSearchResponse = IEsSearchResponse> {
-    // Warning: (ae-forgotten-export) The symbol "AggsStart" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
-    aggs: AggsStart;
-    // (undocumented)
-    asScoped: (request: KibanaRequest) => IScopedSearchClient;
-    getSearchStrategy: (name?: string) => ISearchStrategy<SearchStrategyRequest, SearchStrategyResponse>;
-    searchAsInternalUser: ISearchStrategy;
-    // (undocumented)
-    searchSource: {
-        asScoped: (request: KibanaRequest) => Promise<ISearchStartSearchSource>;
-    };
-}
-
 // Warning: (ae-missing-release-tag) "ISearchStrategy" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public
@@ -1077,23 +608,11 @@ export interface ISearchStrategy<SearchStrategyRequest extends IKibanaSearchRequ
 
 export { KBN_FIELD_TYPES }
 
-// Warning: (ae-missing-release-tag) "KibanaContext" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export type KibanaContext = ExpressionValueSearchContext;
-
 // Warning: (ae-missing-release-tag) "KueryNode" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public @deprecated (undocumented)
 export type KueryNode = KueryNode_2;
 
-// Warning: (ae-missing-release-tag) "mergeCapabilitiesWithFields" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export const mergeCapabilitiesWithFields: (rollupIndexCapabilities: {
-    [key: string]: any;
-}, fieldsFromFieldCapsApi: Record<string, FieldDescriptor>, previousFields?: FieldDescriptor[]) => FieldDescriptor[];
-
 // Warning: (ae-missing-release-tag) "METRIC_TYPES" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -1154,29 +673,6 @@ export class NoSearchIdInSessionError extends KbnError {
     constructor();
 }
 
-// Warning: (ae-missing-release-tag) "OptionedParamType" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export class OptionedParamType extends BaseParamType {
-    constructor(config: Record<string, any>);
-    // (undocumented)
-    options: OptionedValueProp[];
-}
-
-// Warning: (ae-missing-release-tag) "OptionedValueProp" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export interface OptionedValueProp {
-    // (undocumented)
-    disabled?: boolean;
-    // (undocumented)
-    isCompatible: (agg: IAggConfig) => boolean;
-    // (undocumented)
-    text: string;
-    // (undocumented)
-    value: string;
-}
-
 // Warning: (ae-forgotten-export) The symbol "parseEsInterval" needs to be exported by the entry point index.d.ts
 // Warning: (ae-missing-release-tag) "ParsedInterval" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
@@ -1196,18 +692,14 @@ export function parseInterval(interval: string): moment.Duration | null;
 export class Plugin implements Plugin_2<PluginSetup, PluginStart, DataPluginSetupDependencies, DataPluginStartDependencies> {
     constructor(initializerContext: PluginInitializerContext_2<ConfigSchema>);
     // (undocumented)
-    setup(core: CoreSetup<DataPluginStartDependencies, PluginStart>, { bfetch, expressions, usageCollection }: DataPluginSetupDependencies): {
+    setup(core: CoreSetup<DataPluginStartDependencies, PluginStart>, { bfetch, expressions, usageCollection, fieldFormats }: DataPluginSetupDependencies): {
         __enhance: (enhancements: DataEnhancements) => void;
         search: ISearchSetup;
-        fieldFormats: {
-            register: (customFieldFormat: import("../public").FieldFormatInstanceType) => number;
-        };
+        fieldFormats: FieldFormatsSetup;
     };
     // (undocumented)
-    start(core: CoreStart_2): {
-        fieldFormats: {
-            fieldFormatServiceFactory: (uiSettings: import("../../../core/server").IUiSettingsClient) => Promise<import("../common").FieldFormatsRegistry>;
-        };
+    start(core: CoreStart_2, { fieldFormats }: DataPluginStartDependencies): {
+        fieldFormats: FieldFormatsStart;
         indexPatterns: {
             indexPatternsServiceFactory: (savedObjectsClient: Pick<import("../../../core/server").SavedObjectsClient, "update" | "get" | "delete" | "create" | "bulkCreate" | "checkConflicts" | "find" | "bulkGet" | "resolve" | "collectMultiNamespaceReferences" | "updateObjectsSpaces" | "bulkUpdate" | "removeReferencesTo" | "openPointInTimeForType" | "closePointInTime" | "createPointInTimeFinder" | "errors">, elasticsearchClient: import("../../../core/server").ElasticsearchClient) => Promise<import(".").IndexPatternsService>;
         };
@@ -1228,9 +720,7 @@ export function plugin(initializerContext: PluginInitializerContext<ConfigSchema
 export interface PluginSetup {
     // @internal (undocumented)
     __enhance: (enhancements: DataEnhancements) => void;
-    // Warning: (ae-forgotten-export) The symbol "FieldFormatsSetup" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
+    // @deprecated (undocumented)
     fieldFormats: FieldFormatsSetup;
     // (undocumented)
     search: ISearchSetup;
@@ -1240,10 +730,10 @@ export interface PluginSetup {
 //
 // @public (undocumented)
 export interface PluginStart {
-    // Warning: (ae-forgotten-export) The symbol "FieldFormatsStart" needs to be exported by the entry point index.d.ts
-    //
-    // (undocumented)
+    // @deprecated (undocumented)
     fieldFormats: FieldFormatsStart;
+    // Warning: (ae-forgotten-export) The symbol "IndexPatternsServiceStart" needs to be exported by the entry point index.d.ts
+    //
     // (undocumented)
     indexPatterns: IndexPatternsServiceStart;
     // (undocumented)
@@ -1252,16 +742,6 @@ export interface PluginStart {
 
 export { Query }
 
-// Warning: (ae-missing-release-tag) "RefreshInterval" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export interface RefreshInterval {
-    // (undocumented)
-    pause: boolean;
-    // (undocumented)
-    value: number;
-}
-
 // Warning: (ae-missing-release-tag) "search" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -1269,33 +749,10 @@ export const search: {
     aggs: {
         CidrMask: typeof CidrMask;
         dateHistogramInterval: typeof dateHistogramInterval;
-        intervalOptions: ({
-            display: string;
-            val: string;
-            enabled(agg: import("../common").IBucketAggConfig): boolean;
-        } | {
-            display: string;
-            val: string;
-        })[];
-        InvalidEsCalendarIntervalError: typeof InvalidEsCalendarIntervalError;
-        InvalidEsIntervalFormatError: typeof InvalidEsIntervalFormatError;
         IpAddress: typeof IpAddress;
-        isNumberType: (agg: import("../common").AggConfig) => boolean;
-        isStringType: (agg: import("../common").AggConfig) => boolean;
-        isType: (...types: string[]) => (agg: import("../common").AggConfig) => boolean;
-        isValidEsInterval: typeof isValidEsInterval;
-        isValidInterval: typeof isValidInterval;
-        parentPipelineType: string;
-        parseEsInterval: typeof parseEsInterval;
         parseInterval: typeof parseInterval;
-        propFilter: typeof propFilter;
-        siblingPipelineType: string;
-        termsAggFilter: string[];
-        toAbsoluteDates: typeof toAbsoluteDates;
         calcAutoIntervalLessThan: typeof calcAutoIntervalLessThan;
     };
-    tabifyAggResponse: typeof tabifyAggResponse;
-    tabifyGetColumns: typeof tabifyGetColumns;
 };
 
 // Warning: (ae-missing-release-tag) "SearchRequestHandlerContext" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
@@ -1338,27 +795,6 @@ export interface SearchStrategyDependencies {
     uiSettingsClient: IUiSettingsClient;
 }
 
-// Warning: (ae-missing-release-tag) "SearchUsage" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export interface SearchUsage {
-    // (undocumented)
-    trackError(): Promise<void>;
-    // (undocumented)
-    trackSuccess(duration: number): Promise<void>;
-}
-
-// Warning: (ae-missing-release-tag) "searchUsageObserver" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public
-export function searchUsageObserver(logger: Logger_2, usage?: SearchUsage, { isRestore }?: ISearchOptions): {
-    next(response: IEsSearchResponse): void;
-    error(): void;
-};
-
-// @internal
-export const shimAbortSignal: <T>(promise: TransportRequestPromise<T>, signal?: AbortSignal | undefined) => TransportRequestPromise<T>;
-
 // @internal
 export function shimHitsTotal(response: estypes.SearchResponse<unknown>, { legacyHitsTotal }?: ISearchOptions): {
     hits: {
@@ -1396,15 +832,6 @@ export type TimeRange = {
     mode?: 'absolute' | 'relative';
 };
 
-// @internal
-export function toKibanaSearchResponse(rawResponse: estypes.SearchResponse<unknown>): {
-    total: number;
-    loaded: number;
-    rawResponse: estypes.SearchResponse<unknown>;
-    isPartial: boolean;
-    isRunning: boolean;
-};
-
 // Warning: (ae-missing-release-tag) "UI_SETTINGS" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -1425,13 +852,6 @@ export const UI_SETTINGS: {
     readonly HISTOGRAM_BAR_TARGET: "histogram:barTarget";
     readonly HISTOGRAM_MAX_BARS: "histogram:maxBars";
     readonly HISTORY_LIMIT: "history:limit";
-    readonly SHORT_DOTS_ENABLE: "shortDots:enable";
-    readonly FORMAT_DEFAULT_TYPE_MAP: "format:defaultTypeMap";
-    readonly FORMAT_NUMBER_DEFAULT_PATTERN: "format:number:defaultPattern";
-    readonly FORMAT_PERCENT_DEFAULT_PATTERN: "format:percent:defaultPattern";
-    readonly FORMAT_BYTES_DEFAULT_PATTERN: "format:bytes:defaultPattern";
-    readonly FORMAT_CURRENCY_DEFAULT_PATTERN: "format:currency:defaultPattern";
-    readonly FORMAT_NUMBER_DEFAULT_LOCALE: "format:number:defaultLocale";
     readonly TIMEPICKER_REFRESH_INTERVAL_DEFAULTS: "timepicker:refreshIntervalDefaults";
     readonly TIMEPICKER_QUICK_RANGES: "timepicker:quickRanges";
     readonly TIMEPICKER_TIME_DEFAULTS: "timepicker:timeDefaults";
@@ -1442,11 +862,6 @@ export const UI_SETTINGS: {
     readonly AUTOCOMPLETE_VALUE_SUGGESTION_METHOD: "autocomplete:valueSuggestionMethod";
 };
 
-// Warning: (ae-missing-release-tag) "usageProvider" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
-// @public (undocumented)
-export function usageProvider(core: CoreSetup_2): SearchUsage;
-
 
 // Warnings were encountered during analysis:
 //
@@ -1455,38 +870,15 @@ export function usageProvider(core: CoreSetup_2): SearchUsage;
 // src/plugins/data/common/index_patterns/index_patterns/index_pattern.ts:139:7 - (ae-forgotten-export) The symbol "FieldAttrSet" needs to be exported by the entry point index.d.ts
 // src/plugins/data/common/index_patterns/index_patterns/index_pattern.ts:170:7 - (ae-forgotten-export) The symbol "RuntimeField" needs to be exported by the entry point index.d.ts
 // src/plugins/data/server/index.ts:21:23 - (ae-forgotten-export) The symbol "datatableToCSV" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:49:26 - (ae-forgotten-export) The symbol "FieldFormatsRegistry" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:49:26 - (ae-forgotten-export) The symbol "FieldFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:49:26 - (ae-forgotten-export) The symbol "BoolFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:49:26 - (ae-forgotten-export) The symbol "BytesFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:49:26 - (ae-forgotten-export) The symbol "ColorFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:49:26 - (ae-forgotten-export) The symbol "DurationFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:49:26 - (ae-forgotten-export) The symbol "IpFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:49:26 - (ae-forgotten-export) The symbol "NumberFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:49:26 - (ae-forgotten-export) The symbol "PercentFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:49:26 - (ae-forgotten-export) The symbol "RelativeDateFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:49:26 - (ae-forgotten-export) The symbol "SourceFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:49:26 - (ae-forgotten-export) The symbol "StaticLookupFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:49:26 - (ae-forgotten-export) The symbol "UrlFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:49:26 - (ae-forgotten-export) The symbol "StringFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:49:26 - (ae-forgotten-export) The symbol "TruncateFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:49:26 - (ae-forgotten-export) The symbol "HistogramFormat" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:81:27 - (ae-forgotten-export) The symbol "isFilterable" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:81:27 - (ae-forgotten-export) The symbol "isNestedField" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:198:20 - (ae-forgotten-export) The symbol "tabifyAggResponse" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:198:20 - (ae-forgotten-export) The symbol "tabifyGetColumns" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:200:1 - (ae-forgotten-export) The symbol "CidrMask" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:201:1 - (ae-forgotten-export) The symbol "dateHistogramInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:210:1 - (ae-forgotten-export) The symbol "InvalidEsCalendarIntervalError" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:211:1 - (ae-forgotten-export) The symbol "InvalidEsIntervalFormatError" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:212:1 - (ae-forgotten-export) The symbol "IpAddress" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:216:1 - (ae-forgotten-export) The symbol "isValidEsInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:217:1 - (ae-forgotten-export) The symbol "isValidInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:221:1 - (ae-forgotten-export) The symbol "propFilter" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:224:1 - (ae-forgotten-export) The symbol "toAbsoluteDates" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:225:1 - (ae-forgotten-export) The symbol "calcAutoIntervalLessThan" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/plugin.ts:81:74 - (ae-forgotten-export) The symbol "DataEnhancements" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/search/types.ts:120:5 - (ae-forgotten-export) The symbol "ISearchStartSearchSource" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:97:1 - (ae-forgotten-export) The symbol "CidrMask" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:98:1 - (ae-forgotten-export) The symbol "dateHistogramInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:99:1 - (ae-forgotten-export) The symbol "IpAddress" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:101:1 - (ae-forgotten-export) The symbol "calcAutoIntervalLessThan" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/plugin.ts:87:88 - (ae-forgotten-export) The symbol "DataEnhancements" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/plugin.ts:109:7 - (ae-forgotten-export) The symbol "ISearchSetup" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/plugin.ts:110:7 - (ae-forgotten-export) The symbol "FieldFormatsSetup" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/plugin.ts:116:78 - (ae-forgotten-export) The symbol "ISearchStart" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/plugin.ts:117:14 - (ae-forgotten-export) The symbol "FieldFormatsStart" needs to be exported by the entry point index.d.ts
 
 // (No @packageDocumentation comment for this package)
 
diff --git a/src/plugins/data/server/ui_settings.ts b/src/plugins/data/server/ui_settings.ts
index 0723c4b2d85c22..360529ad5a735f 100644
--- a/src/plugins/data/server/ui_settings.ts
+++ b/src/plugins/data/server/ui_settings.ts
@@ -9,8 +9,6 @@
 import { i18n } from '@kbn/i18n';
 import { schema } from '@kbn/config-schema';
 import { UiSettingsParams } from 'kibana/server';
-// @ts-ignore untyped module
-import numeralLanguages from '@elastic/numeral/languages';
 import { DEFAULT_QUERY_LANGUAGE, UI_SETTINGS } from '../common';
 
 const luceneQueryLanguageLabel = i18n.translate('data.advancedSettings.searchQueryLanguageLucene', {
@@ -33,15 +31,6 @@ const requestPreferenceOptionLabels = {
   }),
 };
 
-// We add the `en` key manually here, since that's not a real numeral locale, but the
-// default fallback in case the locale is not found.
-const numeralLanguageIds = [
-  'en',
-  ...numeralLanguages.map((numeralLanguage: any) => {
-    return numeralLanguage.id;
-  }),
-];
-
 export function getUiSettings(): Record<string, UiSettingsParams<unknown>> {
   return {
     [UI_SETTINGS.META_FIELDS]: {
@@ -341,192 +330,6 @@ export function getUiSettings(): Record<string, UiSettingsParams<unknown>> {
       }),
       schema: schema.number(),
     },
-    [UI_SETTINGS.SHORT_DOTS_ENABLE]: {
-      name: i18n.translate('data.advancedSettings.shortenFieldsTitle', {
-        defaultMessage: 'Shorten fields',
-      }),
-      value: false,
-      description: i18n.translate('data.advancedSettings.shortenFieldsText', {
-        defaultMessage: 'Shorten long fields, for example, instead of foo.bar.baz, show f.b.baz',
-      }),
-      schema: schema.boolean(),
-    },
-    [UI_SETTINGS.FORMAT_DEFAULT_TYPE_MAP]: {
-      name: i18n.translate('data.advancedSettings.format.defaultTypeMapTitle', {
-        defaultMessage: 'Field type format name',
-      }),
-      value: `{
-  "ip": { "id": "ip", "params": {} },
-  "date": { "id": "date", "params": {} },
-  "date_nanos": { "id": "date_nanos", "params": {}, "es": true },
-  "number": { "id": "number", "params": {} },
-  "boolean": { "id": "boolean", "params": {} },
-  "histogram": { "id": "histogram", "params": {} },
-  "_source": { "id": "_source", "params": {} },
-  "_default_": { "id": "string", "params": {} }
-}`,
-      type: 'json',
-      description: i18n.translate('data.advancedSettings.format.defaultTypeMapText', {
-        defaultMessage:
-          'Map of the format name to use by default for each field type. ' +
-          '{defaultFormat} is used if the field type is not mentioned explicitly',
-        values: {
-          defaultFormat: '"_default_"',
-        },
-      }),
-      schema: schema.object({
-        ip: schema.object({
-          id: schema.string(),
-          params: schema.object({}),
-        }),
-        date: schema.object({
-          id: schema.string(),
-          params: schema.object({}),
-        }),
-        date_nanos: schema.object({
-          id: schema.string(),
-          params: schema.object({}),
-          es: schema.boolean(),
-        }),
-        number: schema.object({
-          id: schema.string(),
-          params: schema.object({}),
-        }),
-        boolean: schema.object({
-          id: schema.string(),
-          params: schema.object({}),
-        }),
-        histogram: schema.object({
-          id: schema.string(),
-          params: schema.object({}),
-        }),
-        _source: schema.object({
-          id: schema.string(),
-          params: schema.object({}),
-        }),
-        _default_: schema.object({
-          id: schema.string(),
-          params: schema.object({}),
-        }),
-      }),
-    },
-    [UI_SETTINGS.FORMAT_NUMBER_DEFAULT_PATTERN]: {
-      name: i18n.translate('data.advancedSettings.format.numberFormatTitle', {
-        defaultMessage: 'Number format',
-      }),
-      value: '0,0.[000]',
-      type: 'string',
-      description: i18n.translate('data.advancedSettings.format.numberFormatText', {
-        defaultMessage: 'Default {numeralFormatLink} for the "number" format',
-        description:
-          'Part of composite text: data.advancedSettings.format.numberFormatText + ' +
-          'data.advancedSettings.format.numberFormat.numeralFormatLinkText',
-        values: {
-          numeralFormatLink:
-            '<a href="https://www.elastic.co/guide/en/kibana/current/numeral.html" target="_blank" rel="noopener">' +
-            i18n.translate('data.advancedSettings.format.numberFormat.numeralFormatLinkText', {
-              defaultMessage: 'numeral format',
-            }) +
-            '</a>',
-        },
-      }),
-      schema: schema.string(),
-    },
-    [UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN]: {
-      name: i18n.translate('data.advancedSettings.format.percentFormatTitle', {
-        defaultMessage: 'Percent format',
-      }),
-      value: '0,0.[000]%',
-      type: 'string',
-      description: i18n.translate('data.advancedSettings.format.percentFormatText', {
-        defaultMessage: 'Default {numeralFormatLink} for the "percent" format',
-        description:
-          'Part of composite text: data.advancedSettings.format.percentFormatText + ' +
-          'data.advancedSettings.format.percentFormat.numeralFormatLinkText',
-        values: {
-          numeralFormatLink:
-            '<a href="https://www.elastic.co/guide/en/kibana/current/numeral.html" target="_blank" rel="noopener">' +
-            i18n.translate('data.advancedSettings.format.percentFormat.numeralFormatLinkText', {
-              defaultMessage: 'numeral format',
-            }) +
-            '</a>',
-        },
-      }),
-      schema: schema.string(),
-    },
-    [UI_SETTINGS.FORMAT_BYTES_DEFAULT_PATTERN]: {
-      name: i18n.translate('data.advancedSettings.format.bytesFormatTitle', {
-        defaultMessage: 'Bytes format',
-      }),
-      value: '0,0.[0]b',
-      type: 'string',
-      description: i18n.translate('data.advancedSettings.format.bytesFormatText', {
-        defaultMessage: 'Default {numeralFormatLink} for the "bytes" format',
-        description:
-          'Part of composite text: data.advancedSettings.format.bytesFormatText + ' +
-          'data.advancedSettings.format.bytesFormat.numeralFormatLinkText',
-        values: {
-          numeralFormatLink:
-            '<a href="https://www.elastic.co/guide/en/kibana/current/numeral.html" target="_blank" rel="noopener">' +
-            i18n.translate('data.advancedSettings.format.bytesFormat.numeralFormatLinkText', {
-              defaultMessage: 'numeral format',
-            }) +
-            '</a>',
-        },
-      }),
-      schema: schema.string(),
-    },
-    [UI_SETTINGS.FORMAT_CURRENCY_DEFAULT_PATTERN]: {
-      name: i18n.translate('data.advancedSettings.format.currencyFormatTitle', {
-        defaultMessage: 'Currency format',
-      }),
-      value: '($0,0.[00])',
-      type: 'string',
-      description: i18n.translate('data.advancedSettings.format.currencyFormatText', {
-        defaultMessage: 'Default {numeralFormatLink} for the "currency" format',
-        description:
-          'Part of composite text: data.advancedSettings.format.currencyFormatText + ' +
-          'data.advancedSettings.format.currencyFormat.numeralFormatLinkText',
-        values: {
-          numeralFormatLink:
-            '<a href="https://www.elastic.co/guide/en/kibana/current/numeral.html" target="_blank" rel="noopener">' +
-            i18n.translate('data.advancedSettings.format.currencyFormat.numeralFormatLinkText', {
-              defaultMessage: 'numeral format',
-            }) +
-            '</a>',
-        },
-      }),
-      schema: schema.string(),
-    },
-    [UI_SETTINGS.FORMAT_NUMBER_DEFAULT_LOCALE]: {
-      name: i18n.translate('data.advancedSettings.format.formattingLocaleTitle', {
-        defaultMessage: 'Formatting locale',
-      }),
-      value: 'en',
-      type: 'select',
-      options: numeralLanguageIds,
-      optionLabels: Object.fromEntries(
-        numeralLanguages.map((language: Record<string, any>) => [language.id, language.name])
-      ),
-      description: i18n.translate('data.advancedSettings.format.formattingLocaleText', {
-        defaultMessage: `{numeralLanguageLink} locale`,
-        description:
-          'Part of composite text: data.advancedSettings.format.formattingLocale.numeralLanguageLinkText + ' +
-          'data.advancedSettings.format.formattingLocaleText',
-        values: {
-          numeralLanguageLink:
-            '<a href="https://www.elastic.co/guide/en/kibana/current/numeral.html" target="_blank" rel="noopener">' +
-            i18n.translate(
-              'data.advancedSettings.format.formattingLocale.numeralLanguageLinkText',
-              {
-                defaultMessage: 'Numeral language',
-              }
-            ) +
-            '</a>',
-        },
-      }),
-      schema: schema.string(),
-    },
     [UI_SETTINGS.TIMEPICKER_REFRESH_INTERVAL_DEFAULTS]: {
       name: i18n.translate('data.advancedSettings.timepicker.refreshIntervalDefaultsTitle', {
         defaultMessage: 'Time filter refresh interval',
diff --git a/src/plugins/data/tsconfig.json b/src/plugins/data/tsconfig.json
index 9c95878af631eb..6e4e89f7538fd7 100644
--- a/src/plugins/data/tsconfig.json
+++ b/src/plugins/data/tsconfig.json
@@ -23,6 +23,7 @@
     { "path": "../inspector/tsconfig.json" },
     { "path": "../usage_collection/tsconfig.json" },
     { "path": "../kibana_utils/tsconfig.json" },
-    { "path": "../kibana_react/tsconfig.json" }
+    { "path": "../kibana_react/tsconfig.json" },
+    { "path": "../field_formats/tsconfig.json" }
   ]
 }
diff --git a/src/plugins/discover/kibana.json b/src/plugins/discover/kibana.json
index 04469e0ef4276e..f612e0ec2cc8d5 100644
--- a/src/plugins/discover/kibana.json
+++ b/src/plugins/discover/kibana.json
@@ -16,7 +16,7 @@
     "indexPatternFieldEditor"
   ],
   "optionalPlugins": ["home", "share", "usageCollection"],
-  "requiredBundles": ["kibanaUtils", "home", "kibanaReact"],
+  "requiredBundles": ["kibanaUtils", "home", "kibanaReact", "fieldFormats"],
   "owner": {
     "name": "Kibana App",
     "githubTeam": "kibana-app"
diff --git a/src/plugins/discover/public/application/angular/doc_table/components/table_header.ts b/src/plugins/discover/public/application/angular/doc_table/components/table_header.ts
index 5e3a025d8c7baf..0f6c86df0db646 100644
--- a/src/plugins/discover/public/application/angular/doc_table/components/table_header.ts
+++ b/src/plugins/discover/public/application/angular/doc_table/components/table_header.ts
@@ -9,7 +9,7 @@
 import { TableHeader } from './table_header/table_header';
 import { getServices } from '../../../../kibana_services';
 import { SORT_DEFAULT_ORDER_SETTING, DOC_HIDE_TIME_COLUMN_SETTING } from '../../../../../common';
-import { UI_SETTINGS } from '../../../../../../data/public';
+import { FORMATS_UI_SETTINGS } from '../../../../../../field_formats/common';
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export function createTableHeaderDirective(reactDirective: any) {
@@ -30,7 +30,7 @@ export function createTableHeaderDirective(reactDirective: any) {
     { restrict: 'A' },
     {
       hideTimeColumn: config.get(DOC_HIDE_TIME_COLUMN_SETTING, false),
-      isShortDots: config.get(UI_SETTINGS.SHORT_DOTS_ENABLE),
+      isShortDots: config.get(FORMATS_UI_SETTINGS.SHORT_DOTS_ENABLE),
       defaultSortOrder: config.get(SORT_DEFAULT_ORDER_SETTING, 'desc'),
     }
   );
diff --git a/src/plugins/discover/public/application/angular/helpers/row_formatter.test.ts b/src/plugins/discover/public/application/angular/helpers/row_formatter.test.ts
index 80fb8a570f78b0..6b356446850e6f 100644
--- a/src/plugins/discover/public/application/angular/helpers/row_formatter.test.ts
+++ b/src/plugins/discover/public/application/angular/helpers/row_formatter.test.ts
@@ -9,7 +9,7 @@
 import { formatRow, formatTopLevelObject } from './row_formatter';
 import { stubbedSavedObjectIndexPattern } from '../../../__mocks__/stubbed_saved_object_index_pattern';
 import { IndexPattern } from '../../../../../data/common/index_patterns/index_patterns';
-import { fieldFormatsMock } from '../../../../../data/common/field_formats/mocks';
+import { fieldFormatsMock } from '../../../../../field_formats/common/mocks';
 import { setServices } from '../../../kibana_services';
 import { DiscoverServices } from '../../../build_services';
 
diff --git a/src/plugins/discover/public/application/components/source_viewer/__snapshots__/source_viewer.test.tsx.snap b/src/plugins/discover/public/application/components/source_viewer/__snapshots__/source_viewer.test.tsx.snap
index 5f6dabc26659fc..dfded530c69831 100644
--- a/src/plugins/discover/public/application/components/source_viewer/__snapshots__/source_viewer.test.tsx.snap
+++ b/src/plugins/discover/public/application/components/source_viewer/__snapshots__/source_viewer.test.tsx.snap
@@ -167,6 +167,7 @@ exports[`Source Viewer component renders error state 1`] = `
       >
         <span
           className="euiTextColor euiTextColor--subdued"
+          style={Object {}}
         >
           <EuiSpacer
             size="m"
@@ -742,6 +743,7 @@ exports[`Source Viewer component renders loading state 1`] = `
         >
           <div
             className="euiTextColor euiTextColor--subdued"
+            style={Object {}}
           >
             <FormattedMessage
               defaultMessage="Loading JSON"
diff --git a/src/plugins/discover/tsconfig.json b/src/plugins/discover/tsconfig.json
index c0179ad3c8d20a..8c71091e3ecf26 100644
--- a/src/plugins/discover/tsconfig.json
+++ b/src/plugins/discover/tsconfig.json
@@ -24,6 +24,7 @@
     { "path": "../kibana_utils/tsconfig.json" },
     { "path": "../kibana_react/tsconfig.json" },
     { "path": "../kibana_legacy/tsconfig.json" },
-    { "path": "../index_pattern_field_editor/tsconfig.json"}
+    { "path": "../index_pattern_field_editor/tsconfig.json"},
+    { "path": "../field_formats/tsconfig.json" }
   ]
 }
diff --git a/src/plugins/field_formats/README.md b/src/plugins/field_formats/README.md
new file mode 100755
index 00000000000000..1bb519af87acf0
--- /dev/null
+++ b/src/plugins/field_formats/README.md
@@ -0,0 +1,3 @@
+# Field formats
+
+Index pattern fields formatters
diff --git a/src/plugins/data/common/field_formats/constants/base_formatters.ts b/src/plugins/field_formats/common/constants/base_formatters.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/constants/base_formatters.ts
rename to src/plugins/field_formats/common/constants/base_formatters.ts
diff --git a/src/plugins/data/common/field_formats/constants/color_default.ts b/src/plugins/field_formats/common/constants/color_default.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/constants/color_default.ts
rename to src/plugins/field_formats/common/constants/color_default.ts
diff --git a/src/plugins/field_formats/common/constants/ui_settings.ts b/src/plugins/field_formats/common/constants/ui_settings.ts
new file mode 100644
index 00000000000000..98bae6bcf39d37
--- /dev/null
+++ b/src/plugins/field_formats/common/constants/ui_settings.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export const FORMATS_UI_SETTINGS = {
+  FORMAT_DEFAULT_TYPE_MAP: 'format:defaultTypeMap',
+  FORMAT_NUMBER_DEFAULT_PATTERN: 'format:number:defaultPattern',
+  FORMAT_PERCENT_DEFAULT_PATTERN: 'format:percent:defaultPattern',
+  FORMAT_BYTES_DEFAULT_PATTERN: 'format:bytes:defaultPattern',
+  FORMAT_CURRENCY_DEFAULT_PATTERN: 'format:currency:defaultPattern',
+  FORMAT_NUMBER_DEFAULT_LOCALE: 'format:number:defaultLocale',
+  SHORT_DOTS_ENABLE: 'shortDots:enable',
+} as const;
diff --git a/src/plugins/data/common/field_formats/content_types/html_content_type.ts b/src/plugins/field_formats/common/content_types/html_content_type.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/content_types/html_content_type.ts
rename to src/plugins/field_formats/common/content_types/html_content_type.ts
diff --git a/src/plugins/data/common/field_formats/content_types/index.ts b/src/plugins/field_formats/common/content_types/index.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/content_types/index.ts
rename to src/plugins/field_formats/common/content_types/index.ts
diff --git a/src/plugins/data/common/field_formats/content_types/text_content_type.ts b/src/plugins/field_formats/common/content_types/text_content_type.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/content_types/text_content_type.ts
rename to src/plugins/field_formats/common/content_types/text_content_type.ts
diff --git a/src/plugins/data/common/field_formats/converters/boolean.test.ts b/src/plugins/field_formats/common/converters/boolean.test.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/converters/boolean.test.ts
rename to src/plugins/field_formats/common/converters/boolean.test.ts
diff --git a/src/plugins/data/common/field_formats/converters/boolean.ts b/src/plugins/field_formats/common/converters/boolean.ts
similarity index 93%
rename from src/plugins/data/common/field_formats/converters/boolean.ts
rename to src/plugins/field_formats/common/converters/boolean.ts
index d70501bf0f9d5d..7019b6423b89ef 100644
--- a/src/plugins/data/common/field_formats/converters/boolean.ts
+++ b/src/plugins/field_formats/common/converters/boolean.ts
@@ -12,9 +12,10 @@ import { FieldFormat } from '../field_format';
 import { TextContextTypeConvert, FIELD_FORMAT_IDS } from '../types';
 import { asPrettyString } from '../utils';
 
+/** @public */
 export class BoolFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.BOOLEAN;
-  static title = i18n.translate('data.fieldFormats.boolean.title', {
+  static title = i18n.translate('fieldFormats.boolean.title', {
     defaultMessage: 'Boolean',
   });
   static fieldType = [KBN_FIELD_TYPES.BOOLEAN, KBN_FIELD_TYPES.NUMBER, KBN_FIELD_TYPES.STRING];
diff --git a/src/plugins/data/common/field_formats/converters/bytes.test.ts b/src/plugins/field_formats/common/converters/bytes.test.ts
similarity index 85%
rename from src/plugins/data/common/field_formats/converters/bytes.test.ts
rename to src/plugins/field_formats/common/converters/bytes.test.ts
index be8adbb6355ac1..a820b2c1f2b329 100644
--- a/src/plugins/data/common/field_formats/converters/bytes.test.ts
+++ b/src/plugins/field_formats/common/converters/bytes.test.ts
@@ -7,12 +7,12 @@
  */
 
 import { BytesFormat } from './bytes';
-import { UI_SETTINGS } from '../../constants';
+import { FORMATS_UI_SETTINGS } from '../constants/ui_settings';
 
 describe('BytesFormat', () => {
   const config: Record<string, any> = {};
 
-  config[UI_SETTINGS.FORMAT_BYTES_DEFAULT_PATTERN] = '0,0.[000]b';
+  config[FORMATS_UI_SETTINGS.FORMAT_BYTES_DEFAULT_PATTERN] = '0,0.[000]b';
 
   const getConfig = (key: string) => config[key];
 
diff --git a/src/plugins/data/common/field_formats/converters/bytes.ts b/src/plugins/field_formats/common/converters/bytes.ts
similarity index 90%
rename from src/plugins/data/common/field_formats/converters/bytes.ts
rename to src/plugins/field_formats/common/converters/bytes.ts
index 840a59f3d3092d..ce875e0950b252 100644
--- a/src/plugins/data/common/field_formats/converters/bytes.ts
+++ b/src/plugins/field_formats/common/converters/bytes.ts
@@ -10,9 +10,10 @@ import { i18n } from '@kbn/i18n';
 import { NumeralFormat } from './numeral';
 import { FIELD_FORMAT_IDS } from '../types';
 
+/** @public */
 export class BytesFormat extends NumeralFormat {
   static id = FIELD_FORMAT_IDS.BYTES;
-  static title = i18n.translate('data.fieldFormats.bytes.title', {
+  static title = i18n.translate('fieldFormats.bytes.title', {
     defaultMessage: 'Bytes',
   });
 
diff --git a/src/plugins/data/common/field_formats/converters/color.test.ts b/src/plugins/field_formats/common/converters/color.test.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/converters/color.test.ts
rename to src/plugins/field_formats/common/converters/color.test.ts
diff --git a/src/plugins/data/common/field_formats/converters/color.tsx b/src/plugins/field_formats/common/converters/color.tsx
similarity index 96%
rename from src/plugins/data/common/field_formats/converters/color.tsx
rename to src/plugins/field_formats/common/converters/color.tsx
index f653c6a4f82a21..417c2481e626b8 100644
--- a/src/plugins/data/common/field_formats/converters/color.tsx
+++ b/src/plugins/field_formats/common/converters/color.tsx
@@ -16,9 +16,10 @@ import { HtmlContextTypeConvert, FIELD_FORMAT_IDS } from '../types';
 import { asPrettyString } from '../utils';
 import { DEFAULT_CONVERTER_COLOR } from '../constants/color_default';
 
+/** @public */
 export class ColorFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.COLOR;
-  static title = i18n.translate('data.fieldFormats.color.title', {
+  static title = i18n.translate('fieldFormats.color.title', {
     defaultMessage: 'Color',
   });
   static fieldType = [KBN_FIELD_TYPES.NUMBER, KBN_FIELD_TYPES.STRING];
diff --git a/src/plugins/data/common/field_formats/converters/custom.ts b/src/plugins/field_formats/common/converters/custom.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/converters/custom.ts
rename to src/plugins/field_formats/common/converters/custom.ts
diff --git a/src/plugins/data/common/field_formats/converters/date_nanos_shared.test.ts b/src/plugins/field_formats/common/converters/date_nanos_shared.test.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/converters/date_nanos_shared.test.ts
rename to src/plugins/field_formats/common/converters/date_nanos_shared.test.ts
diff --git a/src/plugins/data/common/field_formats/converters/date_nanos_shared.ts b/src/plugins/field_formats/common/converters/date_nanos_shared.ts
similarity index 96%
rename from src/plugins/data/common/field_formats/converters/date_nanos_shared.ts
rename to src/plugins/field_formats/common/converters/date_nanos_shared.ts
index d058d0c6a6574c..1d226c936a977a 100644
--- a/src/plugins/data/common/field_formats/converters/date_nanos_shared.ts
+++ b/src/plugins/field_formats/common/converters/date_nanos_shared.ts
@@ -8,8 +8,9 @@
 
 import { i18n } from '@kbn/i18n';
 import { memoize, noop } from 'lodash';
+import { KBN_FIELD_TYPES } from '@kbn/field-types';
 import moment, { Moment } from 'moment';
-import { FieldFormat, FIELD_FORMAT_IDS, KBN_FIELD_TYPES } from '../../';
+import { FieldFormat, FIELD_FORMAT_IDS } from '../';
 import { TextContextTypeConvert } from '../types';
 
 /**
@@ -59,7 +60,7 @@ export function formatWithNanos(
 
 export class DateNanosFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.DATE_NANOS;
-  static title = i18n.translate('data.fieldFormats.date_nanos.title', {
+  static title = i18n.translate('fieldFormats.date_nanos.title', {
     defaultMessage: 'Date nanos',
   });
   static fieldType = KBN_FIELD_TYPES.DATE;
diff --git a/src/plugins/data/common/field_formats/converters/duration.test.ts b/src/plugins/field_formats/common/converters/duration.test.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/converters/duration.test.ts
rename to src/plugins/field_formats/common/converters/duration.test.ts
diff --git a/src/plugins/data/common/field_formats/converters/duration.ts b/src/plugins/field_formats/common/converters/duration.ts
similarity index 74%
rename from src/plugins/data/common/field_formats/converters/duration.ts
rename to src/plugins/field_formats/common/converters/duration.ts
index 926f907af8fe96..a92a6756b335c8 100644
--- a/src/plugins/data/common/field_formats/converters/duration.ts
+++ b/src/plugins/field_formats/common/converters/duration.ts
@@ -21,76 +21,76 @@ const HUMAN_FRIENDLY = 'humanize';
 const HUMAN_FRIENDLY_PRECISE = 'humanizePrecise';
 const DEFAULT_OUTPUT_PRECISION = 2;
 const DEFAULT_INPUT_FORMAT = {
-  text: i18n.translate('data.fieldFormats.duration.inputFormats.seconds', {
+  text: i18n.translate('fieldFormats.duration.inputFormats.seconds', {
     defaultMessage: 'Seconds',
   }),
   kind: 'seconds',
 };
 const inputFormats = [
   {
-    text: i18n.translate('data.fieldFormats.duration.inputFormats.picoseconds', {
+    text: i18n.translate('fieldFormats.duration.inputFormats.picoseconds', {
       defaultMessage: 'Picoseconds',
     }),
     kind: 'picoseconds',
   },
   {
-    text: i18n.translate('data.fieldFormats.duration.inputFormats.nanoseconds', {
+    text: i18n.translate('fieldFormats.duration.inputFormats.nanoseconds', {
       defaultMessage: 'Nanoseconds',
     }),
     kind: 'nanoseconds',
   },
   {
-    text: i18n.translate('data.fieldFormats.duration.inputFormats.microseconds', {
+    text: i18n.translate('fieldFormats.duration.inputFormats.microseconds', {
       defaultMessage: 'Microseconds',
     }),
     kind: 'microseconds',
   },
   {
-    text: i18n.translate('data.fieldFormats.duration.inputFormats.milliseconds', {
+    text: i18n.translate('fieldFormats.duration.inputFormats.milliseconds', {
       defaultMessage: 'Milliseconds',
     }),
     kind: 'milliseconds',
   },
   { ...DEFAULT_INPUT_FORMAT },
   {
-    text: i18n.translate('data.fieldFormats.duration.inputFormats.minutes', {
+    text: i18n.translate('fieldFormats.duration.inputFormats.minutes', {
       defaultMessage: 'Minutes',
     }),
     kind: 'minutes',
   },
   {
-    text: i18n.translate('data.fieldFormats.duration.inputFormats.hours', {
+    text: i18n.translate('fieldFormats.duration.inputFormats.hours', {
       defaultMessage: 'Hours',
     }),
     kind: 'hours',
   },
   {
-    text: i18n.translate('data.fieldFormats.duration.inputFormats.days', {
+    text: i18n.translate('fieldFormats.duration.inputFormats.days', {
       defaultMessage: 'Days',
     }),
     kind: 'days',
   },
   {
-    text: i18n.translate('data.fieldFormats.duration.inputFormats.weeks', {
+    text: i18n.translate('fieldFormats.duration.inputFormats.weeks', {
       defaultMessage: 'Weeks',
     }),
     kind: 'weeks',
   },
   {
-    text: i18n.translate('data.fieldFormats.duration.inputFormats.months', {
+    text: i18n.translate('fieldFormats.duration.inputFormats.months', {
       defaultMessage: 'Months',
     }),
     kind: 'months',
   },
   {
-    text: i18n.translate('data.fieldFormats.duration.inputFormats.years', {
+    text: i18n.translate('fieldFormats.duration.inputFormats.years', {
       defaultMessage: 'Years',
     }),
     kind: 'years',
   },
 ];
 const DEFAULT_OUTPUT_FORMAT = {
-  text: i18n.translate('data.fieldFormats.duration.outputFormats.humanize.approximate', {
+  text: i18n.translate('fieldFormats.duration.outputFormats.humanize.approximate', {
     defaultMessage: 'Human-readable (approximate)',
   }),
   method: 'humanize',
@@ -98,79 +98,79 @@ const DEFAULT_OUTPUT_FORMAT = {
 const outputFormats = [
   { ...DEFAULT_OUTPUT_FORMAT },
   {
-    text: i18n.translate('data.fieldFormats.duration.outputFormats.humanize.precise', {
+    text: i18n.translate('fieldFormats.duration.outputFormats.humanize.precise', {
       defaultMessage: 'Human-readable (precise)',
     }),
     method: 'humanizePrecise',
   },
   {
-    text: i18n.translate('data.fieldFormats.duration.outputFormats.asMilliseconds', {
+    text: i18n.translate('fieldFormats.duration.outputFormats.asMilliseconds', {
       defaultMessage: 'Milliseconds',
     }),
-    shortText: i18n.translate('data.fieldFormats.duration.outputFormats.asMilliseconds.short', {
+    shortText: i18n.translate('fieldFormats.duration.outputFormats.asMilliseconds.short', {
       defaultMessage: 'ms',
     }),
     method: 'asMilliseconds',
   },
   {
-    text: i18n.translate('data.fieldFormats.duration.outputFormats.asSeconds', {
+    text: i18n.translate('fieldFormats.duration.outputFormats.asSeconds', {
       defaultMessage: 'Seconds',
     }),
-    shortText: i18n.translate('data.fieldFormats.duration.outputFormats.asSeconds.short', {
+    shortText: i18n.translate('fieldFormats.duration.outputFormats.asSeconds.short', {
       defaultMessage: 's',
     }),
     method: 'asSeconds',
   },
   {
-    text: i18n.translate('data.fieldFormats.duration.outputFormats.asMinutes', {
+    text: i18n.translate('fieldFormats.duration.outputFormats.asMinutes', {
       defaultMessage: 'Minutes',
     }),
-    shortText: i18n.translate('data.fieldFormats.duration.outputFormats.asMinutes.short', {
+    shortText: i18n.translate('fieldFormats.duration.outputFormats.asMinutes.short', {
       defaultMessage: 'min',
     }),
     method: 'asMinutes',
   },
   {
-    text: i18n.translate('data.fieldFormats.duration.outputFormats.asHours', {
+    text: i18n.translate('fieldFormats.duration.outputFormats.asHours', {
       defaultMessage: 'Hours',
     }),
-    shortText: i18n.translate('data.fieldFormats.duration.outputFormats.asHours.short', {
+    shortText: i18n.translate('fieldFormats.duration.outputFormats.asHours.short', {
       defaultMessage: 'h',
     }),
     method: 'asHours',
   },
   {
-    text: i18n.translate('data.fieldFormats.duration.outputFormats.asDays', {
+    text: i18n.translate('fieldFormats.duration.outputFormats.asDays', {
       defaultMessage: 'Days',
     }),
-    shortText: i18n.translate('data.fieldFormats.duration.outputFormats.asDays.short', {
+    shortText: i18n.translate('fieldFormats.duration.outputFormats.asDays.short', {
       defaultMessage: 'd',
     }),
     method: 'asDays',
   },
   {
-    text: i18n.translate('data.fieldFormats.duration.outputFormats.asWeeks', {
+    text: i18n.translate('fieldFormats.duration.outputFormats.asWeeks', {
       defaultMessage: 'Weeks',
     }),
-    shortText: i18n.translate('data.fieldFormats.duration.outputFormats.asWeeks.short', {
+    shortText: i18n.translate('fieldFormats.duration.outputFormats.asWeeks.short', {
       defaultMessage: 'w',
     }),
     method: 'asWeeks',
   },
   {
-    text: i18n.translate('data.fieldFormats.duration.outputFormats.asMonths', {
+    text: i18n.translate('fieldFormats.duration.outputFormats.asMonths', {
       defaultMessage: 'Months',
     }),
-    shortText: i18n.translate('data.fieldFormats.duration.outputFormats.asMonths.short', {
+    shortText: i18n.translate('fieldFormats.duration.outputFormats.asMonths.short', {
       defaultMessage: 'mon',
     }),
     method: 'asMonths',
   },
   {
-    text: i18n.translate('data.fieldFormats.duration.outputFormats.asYears', {
+    text: i18n.translate('fieldFormats.duration.outputFormats.asYears', {
       defaultMessage: 'Years',
     }),
-    shortText: i18n.translate('data.fieldFormats.duration.outputFormats.asYears.short', {
+    shortText: i18n.translate('fieldFormats.duration.outputFormats.asYears.short', {
       defaultMessage: 'y',
     }),
     method: 'asYears',
@@ -210,7 +210,7 @@ function formatInputHumanPrecise(
 
 export class DurationFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.DURATION;
-  static title = i18n.translate('data.fieldFormats.duration.title', {
+  static title = i18n.translate('fieldFormats.duration.title', {
     defaultMessage: 'Duration',
   });
   static fieldType = KBN_FIELD_TYPES.NUMBER;
@@ -250,7 +250,7 @@ export class DurationFormat extends FieldFormat {
 
     const prefix =
       val < 0 && human
-        ? i18n.translate('data.fieldFormats.duration.negativeLabel', {
+        ? i18n.translate('fieldFormats.duration.negativeLabel', {
             defaultMessage: 'minus',
           }) + ' '
         : '';
diff --git a/src/plugins/data/common/field_formats/converters/histogram.ts b/src/plugins/field_formats/common/converters/histogram.ts
similarity index 95%
rename from src/plugins/data/common/field_formats/converters/histogram.ts
rename to src/plugins/field_formats/common/converters/histogram.ts
index 0812dcc795dc94..52ddf1bd4ed22a 100644
--- a/src/plugins/data/common/field_formats/converters/histogram.ts
+++ b/src/plugins/field_formats/common/converters/histogram.ts
@@ -14,10 +14,11 @@ import { BytesFormat } from './bytes';
 import { NumberFormat } from './number';
 import { PercentFormat } from './percent';
 
+/** @public */
 export class HistogramFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.HISTOGRAM;
   static fieldType = KBN_FIELD_TYPES.HISTOGRAM;
-  static title = i18n.translate('data.fieldFormats.histogram.title', {
+  static title = i18n.translate('fieldFormats.histogram.title', {
     defaultMessage: 'Histogram',
   });
 
diff --git a/src/plugins/data/common/field_formats/converters/index.ts b/src/plugins/field_formats/common/converters/index.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/converters/index.ts
rename to src/plugins/field_formats/common/converters/index.ts
diff --git a/src/plugins/data/common/field_formats/converters/ip.test.ts b/src/plugins/field_formats/common/converters/ip.test.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/converters/ip.test.ts
rename to src/plugins/field_formats/common/converters/ip.test.ts
diff --git a/src/plugins/data/common/field_formats/converters/ip.ts b/src/plugins/field_formats/common/converters/ip.ts
similarity index 93%
rename from src/plugins/data/common/field_formats/converters/ip.ts
rename to src/plugins/field_formats/common/converters/ip.ts
index 76fe4404e2418f..ad49d679a35266 100644
--- a/src/plugins/data/common/field_formats/converters/ip.ts
+++ b/src/plugins/field_formats/common/converters/ip.ts
@@ -11,9 +11,10 @@ import { KBN_FIELD_TYPES } from '@kbn/field-types';
 import { FieldFormat } from '../field_format';
 import { TextContextTypeConvert, FIELD_FORMAT_IDS } from '../types';
 
+/** @public */
 export class IpFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.IP;
-  static title = i18n.translate('data.fieldFormats.ip.title', {
+  static title = i18n.translate('fieldFormats.ip.title', {
     defaultMessage: 'IP address',
   });
   static fieldType = KBN_FIELD_TYPES.IP;
diff --git a/src/plugins/data/common/field_formats/converters/number.test.ts b/src/plugins/field_formats/common/converters/number.test.ts
similarity index 85%
rename from src/plugins/data/common/field_formats/converters/number.test.ts
rename to src/plugins/field_formats/common/converters/number.test.ts
index 837031b59dc5ce..da849fae1e6aba 100644
--- a/src/plugins/data/common/field_formats/converters/number.test.ts
+++ b/src/plugins/field_formats/common/converters/number.test.ts
@@ -7,12 +7,12 @@
  */
 
 import { NumberFormat } from './number';
-import { UI_SETTINGS } from '../../constants';
+import { FORMATS_UI_SETTINGS } from '../constants/ui_settings';
 
 describe('NumberFormat', () => {
   const config: Record<string, any> = {};
 
-  config[UI_SETTINGS.FORMAT_NUMBER_DEFAULT_PATTERN] = '0,0.[000]';
+  config[FORMATS_UI_SETTINGS.FORMAT_NUMBER_DEFAULT_PATTERN] = '0,0.[000]';
 
   const getConfig = (key: string) => config[key];
 
diff --git a/src/plugins/data/common/field_formats/converters/number.ts b/src/plugins/field_formats/common/converters/number.ts
similarity index 89%
rename from src/plugins/data/common/field_formats/converters/number.ts
rename to src/plugins/field_formats/common/converters/number.ts
index c8c98d010dc61c..8ba4eabde2143a 100644
--- a/src/plugins/data/common/field_formats/converters/number.ts
+++ b/src/plugins/field_formats/common/converters/number.ts
@@ -10,9 +10,10 @@ import { i18n } from '@kbn/i18n';
 import { NumeralFormat } from './numeral';
 import { FIELD_FORMAT_IDS } from '../types';
 
+/** @public */
 export class NumberFormat extends NumeralFormat {
   static id = FIELD_FORMAT_IDS.NUMBER;
-  static title = i18n.translate('data.fieldFormats.number.title', {
+  static title = i18n.translate('fieldFormats.number.title', {
     defaultMessage: 'Number',
   });
 
diff --git a/src/plugins/data/common/field_formats/converters/numeral.ts b/src/plugins/field_formats/common/converters/numeral.ts
similarity index 90%
rename from src/plugins/data/common/field_formats/converters/numeral.ts
rename to src/plugins/field_formats/common/converters/numeral.ts
index 9d8b7ba1c369d4..7f11b6377836df 100644
--- a/src/plugins/data/common/field_formats/converters/numeral.ts
+++ b/src/plugins/field_formats/common/converters/numeral.ts
@@ -13,7 +13,7 @@ import numeralLanguages from '@elastic/numeral/languages';
 import { KBN_FIELD_TYPES } from '@kbn/field-types';
 import { FieldFormat } from '../field_format';
 import { TextContextTypeConvert } from '../types';
-import { UI_SETTINGS } from '../../constants';
+import { FORMATS_UI_SETTINGS } from '../constants/ui_settings';
 
 const numeralInst = numeral();
 
@@ -42,7 +42,7 @@ export abstract class NumeralFormat extends FieldFormat {
 
     const previousLocale = numeral.language();
     const defaultLocale =
-      (this.getConfig && this.getConfig(UI_SETTINGS.FORMAT_NUMBER_DEFAULT_LOCALE)) || 'en';
+      (this.getConfig && this.getConfig(FORMATS_UI_SETTINGS.FORMAT_NUMBER_DEFAULT_LOCALE)) || 'en';
     numeral.language(defaultLocale);
 
     const formatted = numeralInst.set(val).format(this.param('pattern'));
diff --git a/src/plugins/data/common/field_formats/converters/percent.test.ts b/src/plugins/field_formats/common/converters/percent.test.ts
similarity index 85%
rename from src/plugins/data/common/field_formats/converters/percent.test.ts
rename to src/plugins/field_formats/common/converters/percent.test.ts
index 77f4274759ba36..d01acf571f9d94 100644
--- a/src/plugins/data/common/field_formats/converters/percent.test.ts
+++ b/src/plugins/field_formats/common/converters/percent.test.ts
@@ -7,12 +7,12 @@
  */
 
 import { PercentFormat } from './percent';
-import { UI_SETTINGS } from '../../constants';
+import { FORMATS_UI_SETTINGS } from '../constants/ui_settings';
 
 describe('PercentFormat', () => {
   const config: Record<string, any> = {};
 
-  config[UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN] = '0,0.[000]%';
+  config[FORMATS_UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN] = '0,0.[000]%';
 
   const getConfig = (key: string) => config[key];
 
diff --git a/src/plugins/data/common/field_formats/converters/percent.ts b/src/plugins/field_formats/common/converters/percent.ts
similarity index 81%
rename from src/plugins/data/common/field_formats/converters/percent.ts
rename to src/plugins/field_formats/common/converters/percent.ts
index a402975c672e2d..497fb088cd416a 100644
--- a/src/plugins/data/common/field_formats/converters/percent.ts
+++ b/src/plugins/field_formats/common/converters/percent.ts
@@ -9,11 +9,12 @@
 import { i18n } from '@kbn/i18n';
 import { NumeralFormat } from './numeral';
 import { TextContextTypeConvert, FIELD_FORMAT_IDS } from '../types';
-import { UI_SETTINGS } from '../../constants';
+import { FORMATS_UI_SETTINGS } from '../constants/ui_settings';
 
+/** @public */
 export class PercentFormat extends NumeralFormat {
   static id = FIELD_FORMAT_IDS.PERCENT;
-  static title = i18n.translate('data.fieldFormats.percent.title', {
+  static title = i18n.translate('fieldFormats.percent.title', {
     defaultMessage: 'Percentage',
   });
 
@@ -22,7 +23,7 @@ export class PercentFormat extends NumeralFormat {
   allowsNumericalAggregations = true;
 
   getParamDefaults = () => ({
-    pattern: this.getConfig!(UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN),
+    pattern: this.getConfig!(FORMATS_UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN),
     fractional: true,
   });
 
diff --git a/src/plugins/data/common/field_formats/converters/relative_date.test.ts b/src/plugins/field_formats/common/converters/relative_date.test.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/converters/relative_date.test.ts
rename to src/plugins/field_formats/common/converters/relative_date.test.ts
diff --git a/src/plugins/data/common/field_formats/converters/relative_date.ts b/src/plugins/field_formats/common/converters/relative_date.ts
similarity index 92%
rename from src/plugins/data/common/field_formats/converters/relative_date.ts
rename to src/plugins/field_formats/common/converters/relative_date.ts
index c54e32452f2672..cdc54479b150b0 100644
--- a/src/plugins/data/common/field_formats/converters/relative_date.ts
+++ b/src/plugins/field_formats/common/converters/relative_date.ts
@@ -12,9 +12,10 @@ import { KBN_FIELD_TYPES } from '@kbn/field-types';
 import { FieldFormat } from '../field_format';
 import { TextContextTypeConvert, FIELD_FORMAT_IDS } from '../types';
 
+/** @public */
 export class RelativeDateFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.RELATIVE_DATE;
-  static title = i18n.translate('data.fieldFormats.relative_date.title', {
+  static title = i18n.translate('fieldFormats.relative_date.title', {
     defaultMessage: 'Relative date',
   });
   static fieldType = KBN_FIELD_TYPES.DATE;
diff --git a/src/plugins/data/common/field_formats/converters/source.test.ts b/src/plugins/field_formats/common/converters/source.test.ts
similarity index 87%
rename from src/plugins/data/common/field_formats/converters/source.test.ts
rename to src/plugins/field_formats/common/converters/source.test.ts
index 655cf315a05a40..726f2c31e78251 100644
--- a/src/plugins/data/common/field_formats/converters/source.test.ts
+++ b/src/plugins/field_formats/common/converters/source.test.ts
@@ -9,7 +9,21 @@
 import { SourceFormat } from './source';
 import { HtmlContextTypeConvert } from '../types';
 import { HTML_CONTEXT_TYPE } from '../content_types';
-import { stubIndexPatternWithFields } from '../../index_patterns/index_pattern.stub';
+
+export const stubIndexPatternWithFields = {
+  id: '1234',
+  title: 'logstash-*',
+  fields: [
+    {
+      name: 'response',
+      type: 'number',
+      esTypes: ['integer'],
+      aggregatable: true,
+      filterable: true,
+      searchable: true,
+    },
+  ],
+};
 
 describe('Source Format', () => {
   let convertHtml: Function;
diff --git a/src/plugins/data/common/field_formats/converters/source.tsx b/src/plugins/field_formats/common/converters/source.tsx
similarity index 91%
rename from src/plugins/data/common/field_formats/converters/source.tsx
rename to src/plugins/field_formats/common/converters/source.tsx
index de77736503f869..29bae5a41f2f5f 100644
--- a/src/plugins/data/common/field_formats/converters/source.tsx
+++ b/src/plugins/field_formats/common/converters/source.tsx
@@ -6,14 +6,14 @@
  * Side Public License, v 1.
  */
 
+import { KBN_FIELD_TYPES } from '@kbn/field-types';
 import React, { Fragment } from 'react';
 import ReactDOM from 'react-dom/server';
 import { escape, keys } from 'lodash';
-import { KBN_FIELD_TYPES } from '@kbn/field-types';
-import { shortenDottedString } from '../../utils';
+import { shortenDottedString } from '../utils';
 import { FieldFormat } from '../field_format';
 import { TextContextTypeConvert, HtmlContextTypeConvert, FIELD_FORMAT_IDS } from '../types';
-import { UI_SETTINGS } from '../../constants';
+import { FORMATS_UI_SETTINGS } from '../constants/ui_settings';
 
 interface Props {
   defPairs: Array<[string, string]>;
@@ -35,6 +35,7 @@ const TemplateComponent = ({ defPairs }: Props) => {
   );
 };
 
+/** @public */
 export class SourceFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS._SOURCE;
   static title = '_source';
@@ -55,7 +56,7 @@ export class SourceFormat extends FieldFormat {
     const formatted = indexPattern.formatHit(hit);
     const highlightPairs: any[] = [];
     const sourcePairs: any[] = [];
-    const isShortDots = this.getConfig!(UI_SETTINGS.SHORT_DOTS_ENABLE);
+    const isShortDots = this.getConfig!(FORMATS_UI_SETTINGS.SHORT_DOTS_ENABLE);
 
     keys(formatted).forEach((key) => {
       const pairs = highlights[key] ? highlightPairs : sourcePairs;
diff --git a/src/plugins/data/common/field_formats/converters/static_lookup.ts b/src/plugins/field_formats/common/converters/static_lookup.ts
similarity index 94%
rename from src/plugins/data/common/field_formats/converters/static_lookup.ts
rename to src/plugins/field_formats/common/converters/static_lookup.ts
index 63d3506dda0bb2..455f4794887f9f 100644
--- a/src/plugins/data/common/field_formats/converters/static_lookup.ts
+++ b/src/plugins/field_formats/common/converters/static_lookup.ts
@@ -21,9 +21,10 @@ function convertLookupEntriesToMap(lookupEntries: any[]) {
   );
 }
 
+/** @public */
 export class StaticLookupFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.STATIC_LOOKUP;
-  static title = i18n.translate('data.fieldFormats.static_lookup.title', {
+  static title = i18n.translate('fieldFormats.static_lookup.title', {
     defaultMessage: 'Static lookup',
   });
   static fieldType = [
diff --git a/src/plugins/data/common/field_formats/converters/string.test.ts b/src/plugins/field_formats/common/converters/string.test.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/converters/string.test.ts
rename to src/plugins/field_formats/common/converters/string.test.ts
diff --git a/src/plugins/data/common/field_formats/converters/string.ts b/src/plugins/field_formats/common/converters/string.ts
similarity index 80%
rename from src/plugins/data/common/field_formats/converters/string.ts
rename to src/plugins/field_formats/common/converters/string.ts
index c6aba38cf376de..96cd7861478005 100644
--- a/src/plugins/data/common/field_formats/converters/string.ts
+++ b/src/plugins/field_formats/common/converters/string.ts
@@ -9,64 +9,64 @@
 import { escape } from 'lodash';
 import { i18n } from '@kbn/i18n';
 import { KBN_FIELD_TYPES } from '@kbn/field-types';
-import { asPrettyString, getHighlightHtml } from '../utils';
+import { asPrettyString, getHighlightHtml, shortenDottedString } from '../utils';
 import { FieldFormat } from '../field_format';
 import { TextContextTypeConvert, FIELD_FORMAT_IDS, HtmlContextTypeConvert } from '../types';
-import { shortenDottedString } from '../../utils';
 
-const emptyLabel = i18n.translate('data.fieldFormats.string.emptyLabel', {
+const emptyLabel = i18n.translate('fieldFormats.string.emptyLabel', {
   defaultMessage: '(empty)',
 });
 
 const TRANSFORM_OPTIONS = [
   {
     kind: false,
-    text: i18n.translate('data.fieldFormats.string.transformOptions.none', {
+    text: i18n.translate('fieldFormats.string.transformOptions.none', {
       defaultMessage: '- None -',
     }),
   },
   {
     kind: 'lower',
-    text: i18n.translate('data.fieldFormats.string.transformOptions.lower', {
+    text: i18n.translate('fieldFormats.string.transformOptions.lower', {
       defaultMessage: 'Lower Case',
     }),
   },
   {
     kind: 'upper',
-    text: i18n.translate('data.fieldFormats.string.transformOptions.upper', {
+    text: i18n.translate('fieldFormats.string.transformOptions.upper', {
       defaultMessage: 'Upper Case',
     }),
   },
   {
     kind: 'title',
-    text: i18n.translate('data.fieldFormats.string.transformOptions.title', {
+    text: i18n.translate('fieldFormats.string.transformOptions.title', {
       defaultMessage: 'Title Case',
     }),
   },
   {
     kind: 'short',
-    text: i18n.translate('data.fieldFormats.string.transformOptions.short', {
+    text: i18n.translate('fieldFormats.string.transformOptions.short', {
       defaultMessage: 'Short Dots',
     }),
   },
   {
     kind: 'base64',
-    text: i18n.translate('data.fieldFormats.string.transformOptions.base64', {
+    text: i18n.translate('fieldFormats.string.transformOptions.base64', {
       defaultMessage: 'Base64 Decode',
     }),
   },
   {
     kind: 'urlparam',
-    text: i18n.translate('data.fieldFormats.string.transformOptions.url', {
+    text: i18n.translate('fieldFormats.string.transformOptions.url', {
       defaultMessage: 'URL Param Decode',
     }),
   },
 ];
 const DEFAULT_TRANSFORM_OPTION = false;
 
+/** @public */
 export class StringFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.STRING;
-  static title = i18n.translate('data.fieldFormats.string.title', {
+  static title = i18n.translate('fieldFormats.string.title', {
     defaultMessage: 'String',
   });
   static fieldType = [
diff --git a/src/plugins/data/common/field_formats/converters/truncate.test.ts b/src/plugins/field_formats/common/converters/truncate.test.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/converters/truncate.test.ts
rename to src/plugins/field_formats/common/converters/truncate.test.ts
diff --git a/src/plugins/data/common/field_formats/converters/truncate.ts b/src/plugins/field_formats/common/converters/truncate.ts
similarity index 92%
rename from src/plugins/data/common/field_formats/converters/truncate.ts
rename to src/plugins/field_formats/common/converters/truncate.ts
index 4c68a4c056b821..2ac4b515325ebc 100644
--- a/src/plugins/data/common/field_formats/converters/truncate.ts
+++ b/src/plugins/field_formats/common/converters/truncate.ts
@@ -14,9 +14,10 @@ import { TextContextTypeConvert, FIELD_FORMAT_IDS } from '../types';
 
 const omission = '...';
 
+/** @public */
 export class TruncateFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.TRUNCATE;
-  static title = i18n.translate('data.fieldFormats.truncated_string.title', {
+  static title = i18n.translate('fieldFormats.truncated_string.title', {
     defaultMessage: 'Truncated string',
   });
   static fieldType = KBN_FIELD_TYPES.STRING;
diff --git a/src/plugins/data/common/field_formats/converters/url.test.ts b/src/plugins/field_formats/common/converters/url.test.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/converters/url.test.ts
rename to src/plugins/field_formats/common/converters/url.test.ts
diff --git a/src/plugins/data/common/field_formats/converters/url.ts b/src/plugins/field_formats/common/converters/url.ts
similarity index 95%
rename from src/plugins/data/common/field_formats/converters/url.ts
rename to src/plugins/field_formats/common/converters/url.ts
index 3e808d90f04090..930c94f9ce0fa3 100644
--- a/src/plugins/data/common/field_formats/converters/url.ts
+++ b/src/plugins/field_formats/common/converters/url.ts
@@ -24,28 +24,29 @@ const allowedUrlSchemes = ['http://', 'https://'];
 const URL_TYPES = [
   {
     kind: 'a',
-    text: i18n.translate('data.fieldFormats.url.types.link', {
+    text: i18n.translate('fieldFormats.url.types.link', {
       defaultMessage: 'Link',
     }),
   },
   {
     kind: 'img',
-    text: i18n.translate('data.fieldFormats.url.types.img', {
+    text: i18n.translate('fieldFormats.url.types.img', {
       defaultMessage: 'Image',
     }),
   },
   {
     kind: 'audio',
-    text: i18n.translate('data.fieldFormats.url.types.audio', {
+    text: i18n.translate('fieldFormats.url.types.audio', {
       defaultMessage: 'Audio',
     }),
   },
 ];
 const DEFAULT_URL_TYPE = 'a';
 
+/** @public */
 export class UrlFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.URL;
-  static title = i18n.translate('data.fieldFormats.url.title', {
+  static title = i18n.translate('fieldFormats.url.title', {
     defaultMessage: 'Url',
   });
   static fieldType = [
diff --git a/src/plugins/data/common/field_formats/errors.ts b/src/plugins/field_formats/common/errors.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/errors.ts
rename to src/plugins/field_formats/common/errors.ts
diff --git a/src/plugins/data/common/field_formats/field_format.test.ts b/src/plugins/field_formats/common/field_format.test.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/field_format.test.ts
rename to src/plugins/field_formats/common/field_format.test.ts
diff --git a/src/plugins/data/common/field_formats/field_format.ts b/src/plugins/field_formats/common/field_format.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/field_format.ts
rename to src/plugins/field_formats/common/field_format.ts
diff --git a/src/plugins/data/common/field_formats/field_formats_registry.test.ts b/src/plugins/field_formats/common/field_formats_registry.test.ts
similarity index 99%
rename from src/plugins/data/common/field_formats/field_formats_registry.test.ts
rename to src/plugins/field_formats/common/field_formats_registry.test.ts
index 86e44b69c05bfa..e94efc88be20f6 100644
--- a/src/plugins/data/common/field_formats/field_formats_registry.test.ts
+++ b/src/plugins/field_formats/common/field_formats_registry.test.ts
@@ -9,7 +9,7 @@
 import { FieldFormatsRegistry } from './field_formats_registry';
 import { BoolFormat, PercentFormat, StringFormat } from './converters';
 import { FieldFormatsGetConfigFn, FieldFormatInstanceType } from './types';
-import { KBN_FIELD_TYPES } from '../../common';
+import { KBN_FIELD_TYPES } from '@kbn/field-types';
 
 const getValueOfPrivateField = (instance: any, field: string) => instance[field];
 
diff --git a/src/plugins/data/common/field_formats/field_formats_registry.ts b/src/plugins/field_formats/common/field_formats_registry.ts
similarity index 96%
rename from src/plugins/data/common/field_formats/field_formats_registry.ts
rename to src/plugins/field_formats/common/field_formats_registry.ts
index 9e96f5cc1a6bdf..675ec897c2b70e 100644
--- a/src/plugins/data/common/field_formats/field_formats_registry.ts
+++ b/src/plugins/field_formats/common/field_formats_registry.ts
@@ -17,13 +17,13 @@ import {
   FieldFormatInstanceType,
   FieldFormatId,
   IFieldFormatMetaParams,
+  SerializedFieldFormat,
+  FormatFactory,
 } from './types';
 import { baseFormatters } from './constants/base_formatters';
 import { FieldFormat } from './field_format';
-import { FormatFactory } from './utils';
-import { UI_SETTINGS } from '../constants';
-import { FieldFormatNotFoundError } from '../field_formats';
-import { SerializedFieldFormat } from '../../../expressions/common/types';
+import { FORMATS_UI_SETTINGS } from '../common/constants/ui_settings';
+import { FieldFormatNotFoundError } from './errors';
 
 export class FieldFormatsRegistry {
   protected fieldFormats: Map<FieldFormatId, FieldFormatInstanceType> = new Map();
@@ -53,7 +53,7 @@ export class FieldFormatsRegistry {
     metaParamsOptions: Record<string, any> = {},
     defaultFieldConverters: FieldFormatInstanceType[] = baseFormatters
   ) {
-    const defaultTypeMap = getConfig(UI_SETTINGS.FORMAT_DEFAULT_TYPE_MAP);
+    const defaultTypeMap = getConfig(FORMATS_UI_SETTINGS.FORMAT_DEFAULT_TYPE_MAP);
     this.register(defaultFieldConverters);
     this.parseDefaultTypeMap(defaultTypeMap);
     this.getConfig = getConfig;
diff --git a/src/plugins/data/common/field_formats/index.ts b/src/plugins/field_formats/common/index.ts
similarity index 89%
rename from src/plugins/data/common/field_formats/index.ts
rename to src/plugins/field_formats/common/index.ts
index a3d763196e11f1..b6c58eb12d7cd1 100644
--- a/src/plugins/data/common/field_formats/index.ts
+++ b/src/plugins/field_formats/common/index.ts
@@ -8,6 +8,8 @@
 
 import { PublicMethodsOf } from '@kbn/utility-types';
 import { FieldFormatsRegistry } from './field_formats_registry';
+
+/** @public */
 type IFieldFormatsRegistry = PublicMethodsOf<FieldFormatsRegistry>;
 
 export { FieldFormatsRegistry, IFieldFormatsRegistry };
@@ -33,6 +35,7 @@ export {
 export { getHighlightRequest } from './utils';
 
 export { DEFAULT_CONVERTER_COLOR } from './constants/color_default';
+export { FORMATS_UI_SETTINGS } from './constants/ui_settings';
 export { FIELD_FORMAT_IDS } from './types';
 export { HTML_CONTEXT_TYPE, TEXT_CONTEXT_TYPE } from './content_types';
 
@@ -41,7 +44,9 @@ export {
   FieldFormatsContentType,
   FieldFormatConfig,
   FieldFormatId,
-  // Used in data plugin only
+  SerializedFieldFormat,
+  FormatFactory,
+  // Used in field format plugin only
   FieldFormatInstanceType,
   IFieldFormat,
   FieldFormatsStartCommon,
diff --git a/src/plugins/data/common/field_formats/mocks.ts b/src/plugins/field_formats/common/mocks.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/mocks.ts
rename to src/plugins/field_formats/common/mocks.ts
diff --git a/src/plugins/data/common/field_formats/types.ts b/src/plugins/field_formats/common/types.ts
similarity index 72%
rename from src/plugins/data/common/field_formats/types.ts
rename to src/plugins/field_formats/common/types.ts
index c09106751815f3..c6048e1367a09e 100644
--- a/src/plugins/data/common/field_formats/types.ts
+++ b/src/plugins/field_formats/common/types.ts
@@ -6,7 +6,6 @@
  * Side Public License, v 1.
  */
 
-import { GetConfigFn } from '../types';
 import { FieldFormat } from './field_format';
 import { FieldFormatsRegistry } from './field_formats_registry';
 
@@ -59,13 +58,26 @@ export enum FIELD_FORMAT_IDS {
   HISTOGRAM = 'histogram',
 }
 
+/** @public */
 export interface FieldFormatConfig {
   id: FieldFormatId;
   params: Record<string, any>;
   es?: boolean;
 }
 
-export type FieldFormatsGetConfigFn = GetConfigFn;
+/**
+ * If a service is being shared on both the client and the server, and
+ * the client code requires synchronous access to uiSettings, both client
+ * and server should wrap the core uiSettings services in a function
+ * matching this signature.
+ *
+ * This matches the signature of the public `core.uiSettings.get`, and
+ * should only be used in scenarios where async access to uiSettings is
+ * not possible.
+ * 
+ @public
+ */
+export type FieldFormatsGetConfigFn = <T = any>(key: string, defaultOverride?: T) => T;
 
 export type IFieldFormat = FieldFormat;
 
@@ -96,3 +108,17 @@ export interface IFieldFormatMetaParams {
 }
 
 export type FieldFormatsStartCommon = Omit<FieldFormatsRegistry, 'init' | 'register'>;
+
+/**
+ * JSON representation of a field formatter configuration.
+ * Is used to carry information about how to format data in
+ * a data table as part of the column definition.
+ *
+ * @public
+ */
+export interface SerializedFieldFormat<TParams = Record<string, any>> {
+  id?: string;
+  params?: TParams;
+}
+
+export type FormatFactory = (mapping?: SerializedFieldFormat) => IFieldFormat;
diff --git a/src/plugins/data/common/field_formats/utils/as_pretty_string.test.ts b/src/plugins/field_formats/common/utils/as_pretty_string.test.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/utils/as_pretty_string.test.ts
rename to src/plugins/field_formats/common/utils/as_pretty_string.test.ts
diff --git a/src/plugins/data/common/field_formats/utils/as_pretty_string.ts b/src/plugins/field_formats/common/utils/as_pretty_string.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/utils/as_pretty_string.ts
rename to src/plugins/field_formats/common/utils/as_pretty_string.ts
diff --git a/src/plugins/data/common/field_formats/utils/highlight/highlight_html.test.ts b/src/plugins/field_formats/common/utils/highlight/highlight_html.test.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/utils/highlight/highlight_html.test.ts
rename to src/plugins/field_formats/common/utils/highlight/highlight_html.test.ts
diff --git a/src/plugins/data/common/field_formats/utils/highlight/highlight_html.ts b/src/plugins/field_formats/common/utils/highlight/highlight_html.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/utils/highlight/highlight_html.ts
rename to src/plugins/field_formats/common/utils/highlight/highlight_html.ts
diff --git a/src/plugins/data/common/field_formats/utils/highlight/highlight_request.test.ts b/src/plugins/field_formats/common/utils/highlight/highlight_request.test.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/utils/highlight/highlight_request.test.ts
rename to src/plugins/field_formats/common/utils/highlight/highlight_request.test.ts
diff --git a/src/plugins/data/common/field_formats/utils/highlight/highlight_request.ts b/src/plugins/field_formats/common/utils/highlight/highlight_request.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/utils/highlight/highlight_request.ts
rename to src/plugins/field_formats/common/utils/highlight/highlight_request.ts
diff --git a/src/plugins/data/common/field_formats/utils/highlight/highlight_tags.ts b/src/plugins/field_formats/common/utils/highlight/highlight_tags.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/utils/highlight/highlight_tags.ts
rename to src/plugins/field_formats/common/utils/highlight/highlight_tags.ts
diff --git a/src/plugins/data/common/field_formats/utils/highlight/html_tags.ts b/src/plugins/field_formats/common/utils/highlight/html_tags.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/utils/highlight/html_tags.ts
rename to src/plugins/field_formats/common/utils/highlight/html_tags.ts
diff --git a/src/plugins/data/common/field_formats/utils/highlight/index.ts b/src/plugins/field_formats/common/utils/highlight/index.ts
similarity index 100%
rename from src/plugins/data/common/field_formats/utils/highlight/index.ts
rename to src/plugins/field_formats/common/utils/highlight/index.ts
diff --git a/src/plugins/data/common/field_formats/utils/index.ts b/src/plugins/field_formats/common/utils/index.ts
similarity index 70%
rename from src/plugins/data/common/field_formats/utils/index.ts
rename to src/plugins/field_formats/common/utils/index.ts
index 5771c0166075db..3cfa0241c6f414 100644
--- a/src/plugins/data/common/field_formats/utils/index.ts
+++ b/src/plugins/field_formats/common/utils/index.ts
@@ -6,10 +6,6 @@
  * Side Public License, v 1.
  */
 
-import { SerializedFieldFormat } from '../../../../expressions/common/types';
-import { IFieldFormat } from '../index';
-
 export { asPrettyString } from './as_pretty_string';
 export { getHighlightHtml, getHighlightRequest } from './highlight';
-
-export type FormatFactory = (mapping?: SerializedFieldFormat) => IFieldFormat;
+export { shortenDottedString } from './shorten_dotted_string';
diff --git a/src/plugins/field_formats/common/utils/shorten_dotted_string.test.ts b/src/plugins/field_formats/common/utils/shorten_dotted_string.test.ts
new file mode 100644
index 00000000000000..33a44925982ecf
--- /dev/null
+++ b/src/plugins/field_formats/common/utils/shorten_dotted_string.test.ts
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { shortenDottedString } from './shorten_dotted_string';
+
+describe('shortenDottedString', () => {
+  test('should convert a dot.notated.string into a short string', () => {
+    expect(shortenDottedString('dot.notated.string')).toBe('d.n.string');
+  });
+
+  test('should ignore non-string values', () => {
+    const obj = { key: 'val' };
+
+    expect(shortenDottedString(true)).toBe(true);
+    expect(shortenDottedString(123)).toBe(123);
+    expect(shortenDottedString(obj)).toBe(obj);
+  });
+});
diff --git a/src/plugins/field_formats/common/utils/shorten_dotted_string.ts b/src/plugins/field_formats/common/utils/shorten_dotted_string.ts
new file mode 100644
index 00000000000000..53f7471913dc3e
--- /dev/null
+++ b/src/plugins/field_formats/common/utils/shorten_dotted_string.ts
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+const DOT_PREFIX_RE = /(.).+?\./g;
+
+/**
+ * Convert a dot.notated.string into a short
+ * version (d.n.string)
+ *
+ * @return {any}
+ */
+export function shortenDottedString(input: any) {
+  return typeof input !== 'string' ? input : input.replace(DOT_PREFIX_RE, '$1.');
+}
diff --git a/src/plugins/field_formats/jest.config.js b/src/plugins/field_formats/jest.config.js
new file mode 100644
index 00000000000000..ea20fcfec6d099
--- /dev/null
+++ b/src/plugins/field_formats/jest.config.js
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test',
+  rootDir: '../../..',
+  roots: ['<rootDir>/src/plugins/field_formats'],
+};
diff --git a/src/plugins/field_formats/kibana.json b/src/plugins/field_formats/kibana.json
new file mode 100755
index 00000000000000..ee5529697851d1
--- /dev/null
+++ b/src/plugins/field_formats/kibana.json
@@ -0,0 +1,15 @@
+{
+  "id": "fieldFormats",
+  "version": "1.0.0",
+  "kibanaVersion": "kibana",
+  "server": true,
+  "ui": true,
+  "extraPublicDirs": ["common"],
+  "requiredPlugins": [],
+  "optionalPlugins": [],
+  "owner": {
+    "name": "App Services",
+    "githubTeam": "kibana-app-services"
+  },
+  "description": "Index pattern fields and ambiguous values formatters"
+}
diff --git a/src/plugins/field_formats/public/index.scss b/src/plugins/field_formats/public/index.scss
new file mode 100644
index 00000000000000..7928d81b1f565f
--- /dev/null
+++ b/src/plugins/field_formats/public/index.scss
@@ -0,0 +1 @@
+@import './lib/converters/index';
diff --git a/src/plugins/field_formats/public/index.ts b/src/plugins/field_formats/public/index.ts
new file mode 100755
index 00000000000000..f765513fb4c4c4
--- /dev/null
+++ b/src/plugins/field_formats/public/index.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { FieldFormatsPlugin } from './plugin';
+export { DateFormat, DateNanosFormat } from './lib/converters';
+
+export function plugin() {
+  return new FieldFormatsPlugin();
+}
+export { FieldFormatsSetup, FieldFormatsStart } from './plugin';
diff --git a/src/plugins/data/public/field_formats/constants.ts b/src/plugins/field_formats/public/lib/constants.ts
similarity index 100%
rename from src/plugins/data/public/field_formats/constants.ts
rename to src/plugins/field_formats/public/lib/constants.ts
diff --git a/src/plugins/data/public/field_formats/converters/_index.scss b/src/plugins/field_formats/public/lib/converters/_index.scss
similarity index 100%
rename from src/plugins/data/public/field_formats/converters/_index.scss
rename to src/plugins/field_formats/public/lib/converters/_index.scss
diff --git a/src/plugins/data/public/field_formats/converters/_string.scss b/src/plugins/field_formats/public/lib/converters/_string.scss
similarity index 100%
rename from src/plugins/data/public/field_formats/converters/_string.scss
rename to src/plugins/field_formats/public/lib/converters/_string.scss
diff --git a/src/plugins/data/public/field_formats/converters/date.test.ts b/src/plugins/field_formats/public/lib/converters/date.test.ts
similarity index 100%
rename from src/plugins/data/public/field_formats/converters/date.test.ts
rename to src/plugins/field_formats/public/lib/converters/date.test.ts
diff --git a/src/plugins/data/public/field_formats/converters/date.ts b/src/plugins/field_formats/public/lib/converters/date.ts
similarity index 87%
rename from src/plugins/data/public/field_formats/converters/date.ts
rename to src/plugins/field_formats/public/lib/converters/date.ts
index 1d74e6095427d8..acc051afd6b1da 100644
--- a/src/plugins/data/public/field_formats/converters/date.ts
+++ b/src/plugins/field_formats/public/lib/converters/date.ts
@@ -9,12 +9,13 @@
 import { i18n } from '@kbn/i18n';
 import { memoize, noop } from 'lodash';
 import moment from 'moment';
-import { FieldFormat, KBN_FIELD_TYPES, FIELD_FORMAT_IDS } from '../../../common';
-import { TextContextTypeConvert } from '../../../common/field_formats/types';
+import { KBN_FIELD_TYPES } from '@kbn/field-types';
+import { FieldFormat, FIELD_FORMAT_IDS } from '../../../common';
+import { TextContextTypeConvert } from '../../../common/types';
 
 export class DateFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.DATE;
-  static title = i18n.translate('data.fieldFormats.date.title', {
+  static title = i18n.translate('fieldFormats.date.title', {
     defaultMessage: 'Date',
   });
   static fieldType = KBN_FIELD_TYPES.DATE;
diff --git a/src/plugins/data/public/field_formats/converters/date_nanos.ts b/src/plugins/field_formats/public/lib/converters/date_nanos.ts
similarity index 79%
rename from src/plugins/data/public/field_formats/converters/date_nanos.ts
rename to src/plugins/field_formats/public/lib/converters/date_nanos.ts
index f94d0e47a8ed4d..c2e0b3f929067f 100644
--- a/src/plugins/data/public/field_formats/converters/date_nanos.ts
+++ b/src/plugins/field_formats/public/lib/converters/date_nanos.ts
@@ -6,4 +6,4 @@
  * Side Public License, v 1.
  */
 
-export { DateNanosFormat } from '../../../common/field_formats/converters/date_nanos_shared';
+export { DateNanosFormat } from '../../../common/converters/date_nanos_shared';
diff --git a/src/plugins/data/public/field_formats/converters/index.ts b/src/plugins/field_formats/public/lib/converters/index.ts
similarity index 100%
rename from src/plugins/data/public/field_formats/converters/index.ts
rename to src/plugins/field_formats/public/lib/converters/index.ts
diff --git a/src/plugins/data/public/field_formats/index.ts b/src/plugins/field_formats/public/lib/index.ts
similarity index 82%
rename from src/plugins/data/public/field_formats/index.ts
rename to src/plugins/field_formats/public/lib/index.ts
index 8b8b00b2b8746c..83a2dc60d8d952 100644
--- a/src/plugins/data/public/field_formats/index.ts
+++ b/src/plugins/field_formats/public/lib/index.ts
@@ -6,6 +6,5 @@
  * Side Public License, v 1.
  */
 
-export { FieldFormatsService, FieldFormatsSetup, FieldFormatsStart } from './field_formats_service';
 export { DateFormat, DateNanosFormat } from './converters';
 export { baseFormattersPublic } from './constants';
diff --git a/src/plugins/data/public/field_formats/mocks.ts b/src/plugins/field_formats/public/mocks.ts
similarity index 56%
rename from src/plugins/data/public/field_formats/mocks.ts
rename to src/plugins/field_formats/public/mocks.ts
index 883af759392206..53f8cf3a174945 100644
--- a/src/plugins/data/public/field_formats/mocks.ts
+++ b/src/plugins/field_formats/public/mocks.ts
@@ -6,17 +6,26 @@
  * Side Public License, v 1.
  */
 
-import type { PublicMethodsOf } from '@kbn/utility-types';
-import { FieldFormatsStart, FieldFormatsSetup, FieldFormatsService } from '.';
-import { fieldFormatsMock } from '../../common/field_formats/mocks';
+import { CoreSetup } from 'src/core/public';
+import { baseFormattersPublic } from './lib/constants';
+import { FieldFormatsRegistry } from '../common';
+import type { FieldFormatsStart, FieldFormatsSetup } from '.';
+import { fieldFormatsMock } from '../common/mocks';
 
-type FieldFormatsServiceClientContract = PublicMethodsOf<FieldFormatsService>;
+export const getFieldFormatsRegistry = (core: CoreSetup) => {
+  const fieldFormatsRegistry = new FieldFormatsRegistry();
+  const getConfig = core.uiSettings.get.bind(core.uiSettings);
+
+  fieldFormatsRegistry.init(getConfig, {}, baseFormattersPublic);
+
+  return fieldFormatsRegistry;
+};
 
 const createSetupContractMock = () => fieldFormatsMock as FieldFormatsSetup;
 const createStartContractMock = () => fieldFormatsMock as FieldFormatsStart;
 
 const createMock = () => {
-  const mocked: jest.Mocked<FieldFormatsServiceClientContract> = {
+  const mocked: jest.Mocked<{ start: () => FieldFormatsStart; setup: () => FieldFormatsSetup }> = {
     setup: jest.fn().mockReturnValue(createSetupContractMock()),
     start: jest.fn().mockReturnValue(createStartContractMock()),
   };
diff --git a/src/plugins/data/public/field_formats/field_formats_service.test.ts b/src/plugins/field_formats/public/plugin.test.ts
similarity index 51%
rename from src/plugins/data/public/field_formats/field_formats_service.test.ts
rename to src/plugins/field_formats/public/plugin.test.ts
index 06d007b2aff009..808413667918d2 100644
--- a/src/plugins/data/public/field_formats/field_formats_service.test.ts
+++ b/src/plugins/field_formats/public/plugin.test.ts
@@ -6,18 +6,18 @@
  * Side Public License, v 1.
  */
 
-import { FieldFormatsService } from './field_formats_service';
-import { coreMock } from '../../../../../src/core/public/mocks';
-import { DateFormat } from './converters/date';
+import { coreMock } from '../../../../src/core/public/mocks';
+import { DateFormat } from './lib/converters/date';
+import { FieldFormatsPlugin } from './plugin';
 
-describe('FieldFormatService', () => {
+describe('FieldFormatsPublic', () => {
   test('DateFormat is public version', () => {
     const mockCore = coreMock.createSetup();
-    const service = new FieldFormatsService();
-    service.setup(mockCore);
-    const fieldFormatsRegistry = service.start();
-    const DateFormatFromRegsitry = fieldFormatsRegistry.getTypeWithoutMetaParams('date');
+    const plugin = new FieldFormatsPlugin();
+    plugin.setup(mockCore);
+    const fieldFormatsRegistry = plugin.start();
+    const DateFormatFromRegistry = fieldFormatsRegistry.getTypeWithoutMetaParams('date');
 
-    expect(DateFormatFromRegsitry).toEqual(DateFormat);
+    expect(DateFormatFromRegistry).toEqual(DateFormat);
   });
 });
diff --git a/src/plugins/data/public/field_formats/field_formats_service.ts b/src/plugins/field_formats/public/plugin.ts
old mode 100644
new mode 100755
similarity index 73%
rename from src/plugins/data/public/field_formats/field_formats_service.ts
rename to src/plugins/field_formats/public/plugin.ts
index 041d0d7dd0e1c8..0e90aa9b48c8ed
--- a/src/plugins/data/public/field_formats/field_formats_service.ts
+++ b/src/plugins/field_formats/public/plugin.ts
@@ -6,17 +6,18 @@
  * Side Public License, v 1.
  */
 
-import { CoreSetup } from 'src/core/public';
-import { FieldFormatsRegistry, UI_SETTINGS } from '../../common';
-import { FormatFactory } from '../../common/field_formats/utils';
-import { baseFormattersPublic } from './constants';
+import { CoreSetup, Plugin } from '../../../core/public';
+import { FieldFormatsRegistry, FORMATS_UI_SETTINGS } from '../common';
+import { baseFormattersPublic } from './lib';
+import { FormatFactory } from '../common/types';
+import './index.scss';
 
-export class FieldFormatsService {
+export class FieldFormatsPlugin implements Plugin<FieldFormatsSetup, FieldFormatsStart> {
   private readonly fieldFormatsRegistry: FieldFormatsRegistry = new FieldFormatsRegistry();
 
-  public setup(core: CoreSetup) {
+  public setup(core: CoreSetup): FieldFormatsSetup {
     core.uiSettings.getUpdate$().subscribe(({ key, newValue }) => {
-      if (key === UI_SETTINGS.FORMAT_DEFAULT_TYPE_MAP) {
+      if (key === FORMATS_UI_SETTINGS.FORMAT_DEFAULT_TYPE_MAP) {
         this.fieldFormatsRegistry.parseDefaultTypeMap(newValue);
       }
     });
@@ -41,6 +42,8 @@ export class FieldFormatsService {
   public start() {
     return this.fieldFormatsRegistry as FieldFormatsStart;
   }
+
+  public stop() {}
 }
 
 /** @public */
diff --git a/src/plugins/field_formats/server/index.ts b/src/plugins/field_formats/server/index.ts
new file mode 100755
index 00000000000000..44de8fde558ec4
--- /dev/null
+++ b/src/plugins/field_formats/server/index.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { PluginInitializerContext } from '../../../core/server';
+import { FieldFormatsPlugin } from './plugin';
+export { DateFormat, DateNanosFormat } from './lib/converters';
+
+export function plugin(initializerContext: PluginInitializerContext) {
+  return new FieldFormatsPlugin(initializerContext);
+}
+
+export { FieldFormatsSetup, FieldFormatsStart } from './types';
diff --git a/src/plugins/data/server/field_formats/converters/date_nanos_server.test.ts b/src/plugins/field_formats/server/lib/converters/date_nanos_server.test.ts
similarity index 97%
rename from src/plugins/data/server/field_formats/converters/date_nanos_server.test.ts
rename to src/plugins/field_formats/server/lib/converters/date_nanos_server.test.ts
index 3353f4a959b7eb..86f0b2a7dc875c 100644
--- a/src/plugins/data/server/field_formats/converters/date_nanos_server.test.ts
+++ b/src/plugins/field_formats/server/lib/converters/date_nanos_server.test.ts
@@ -7,7 +7,7 @@
  */
 
 import { DateNanosFormat } from './date_nanos_server';
-import { FieldFormatsGetConfigFn } from 'src/plugins/data/common';
+import { FieldFormatsGetConfigFn } from '../../../common';
 
 describe('Date Nanos Format: Server side edition', () => {
   let convert: Function;
diff --git a/src/plugins/data/server/field_formats/converters/date_nanos_server.ts b/src/plugins/field_formats/server/lib/converters/date_nanos_server.ts
similarity index 94%
rename from src/plugins/data/server/field_formats/converters/date_nanos_server.ts
rename to src/plugins/field_formats/server/lib/converters/date_nanos_server.ts
index 655c76d328f47a..d47475f6274fac 100644
--- a/src/plugins/data/server/field_formats/converters/date_nanos_server.ts
+++ b/src/plugins/field_formats/server/lib/converters/date_nanos_server.ts
@@ -12,8 +12,8 @@ import {
   analysePatternForFract,
   DateNanosFormat,
   formatWithNanos,
-} from '../../../common/field_formats/converters/date_nanos_shared';
-import { TextContextTypeConvert } from '../../../common/field_formats/types';
+} from '../../../common/converters/date_nanos_shared';
+import { TextContextTypeConvert } from '../../../common/types';
 
 class DateNanosFormatServer extends DateNanosFormat {
   textConvert: TextContextTypeConvert = (val) => {
diff --git a/src/plugins/data/server/field_formats/converters/date_server.ts b/src/plugins/field_formats/server/lib/converters/date_server.ts
similarity index 90%
rename from src/plugins/data/server/field_formats/converters/date_server.ts
rename to src/plugins/field_formats/server/lib/converters/date_server.ts
index a86f3c894c5437..bf2151db0072c8 100644
--- a/src/plugins/data/server/field_formats/converters/date_server.ts
+++ b/src/plugins/field_formats/server/lib/converters/date_server.ts
@@ -9,20 +9,13 @@
 import { i18n } from '@kbn/i18n';
 import { memoize, noop } from 'lodash';
 import moment from 'moment-timezone';
-import {
-  FieldFormat,
-  KBN_FIELD_TYPES,
-  FIELD_FORMAT_IDS,
-  FieldFormatsGetConfigFn,
-} from '../../../common';
-import {
-  IFieldFormatMetaParams,
-  TextContextTypeConvert,
-} from '../../../common/field_formats/types';
+import { KBN_FIELD_TYPES } from '@kbn/field-types';
+import { FieldFormat, FIELD_FORMAT_IDS, FieldFormatsGetConfigFn } from '../../../common';
+import { IFieldFormatMetaParams, TextContextTypeConvert } from '../../../common/types';
 
 export class DateFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.DATE;
-  static title = i18n.translate('data.fieldFormats.date.title', {
+  static title = i18n.translate('fieldFormats.date.title', {
     defaultMessage: 'Date',
   });
   static fieldType = KBN_FIELD_TYPES.DATE;
diff --git a/src/plugins/data/server/field_formats/converters/index.ts b/src/plugins/field_formats/server/lib/converters/index.ts
similarity index 100%
rename from src/plugins/data/server/field_formats/converters/index.ts
rename to src/plugins/field_formats/server/lib/converters/index.ts
diff --git a/src/plugins/data/server/field_formats/mocks.ts b/src/plugins/field_formats/server/mocks.ts
similarity index 100%
rename from src/plugins/data/server/field_formats/mocks.ts
rename to src/plugins/field_formats/server/mocks.ts
diff --git a/src/plugins/data/server/field_formats/field_formats_service.test.ts b/src/plugins/field_formats/server/plugin.test.ts
similarity index 58%
rename from src/plugins/data/server/field_formats/field_formats_service.test.ts
rename to src/plugins/field_formats/server/plugin.test.ts
index 0bfa9f89117e87..266d724ce5e220 100644
--- a/src/plugins/data/server/field_formats/field_formats_service.test.ts
+++ b/src/plugins/field_formats/server/plugin.test.ts
@@ -6,16 +6,16 @@
  * Side Public License, v 1.
  */
 
-import { FieldFormatsService } from './field_formats_service';
-import { DateFormat } from './converters/date_server';
-import { coreMock } from '../../../../core/server/mocks';
+import { DateFormat } from './lib/converters/date_server';
+import { coreMock } from '../../../core/server/mocks';
+import { FieldFormatsPlugin } from './plugin';
 
-describe('FieldFormatService', () => {
+describe('FieldFormats registry server plugin', () => {
   test('DateFormat is server version', async () => {
-    const service = new FieldFormatsService();
-    const fieldFormatsService = await service.start();
+    const plugin = new FieldFormatsPlugin(coreMock.createPluginInitializerContext());
+    const pluginStart = await plugin.start(coreMock.createStart());
     const uiSettings = coreMock.createStart().uiSettings.asScopedToClient({} as any);
-    const fieldFormatsRegistry = await fieldFormatsService.fieldFormatServiceFactory(uiSettings);
+    const fieldFormatsRegistry = await pluginStart.fieldFormatServiceFactory(uiSettings);
     const DateFormatFromRegsitry = fieldFormatsRegistry.getTypeWithoutMetaParams('date');
 
     expect(DateFormatFromRegsitry).toEqual(DateFormat);
diff --git a/src/plugins/data/server/field_formats/field_formats_service.ts b/src/plugins/field_formats/server/plugin.ts
old mode 100644
new mode 100755
similarity index 60%
rename from src/plugins/data/server/field_formats/field_formats_service.ts
rename to src/plugins/field_formats/server/plugin.ts
index fa94e5dcef9cf8..e2c64807433a99
--- a/src/plugins/data/server/field_formats/field_formats_service.ts
+++ b/src/plugins/field_formats/server/plugin.ts
@@ -8,28 +8,36 @@
 
 import { has } from 'lodash';
 import {
-  FieldFormatsRegistry,
-  FieldFormatInstanceType,
-  baseFormatters,
-} from '../../common/field_formats';
-import { IUiSettingsClient } from '../../../../core/server';
-import { DateFormat, DateNanosFormat } from './converters';
-
-export class FieldFormatsService {
-  private readonly fieldFormatClasses: FieldFormatInstanceType[] = [
+  PluginInitializerContext,
+  CoreSetup,
+  CoreStart,
+  Plugin,
+  IUiSettingsClient,
+} from '../../../core/server';
+import { FieldFormatsStart, FieldFormatsSetup } from './types';
+import { DateFormat, DateNanosFormat } from './lib/converters';
+import { baseFormatters, FieldFormatInstanceType, FieldFormatsRegistry } from '../common';
+import { getUiSettings } from './ui_settings';
+
+export class FieldFormatsPlugin implements Plugin<FieldFormatsSetup, FieldFormatsStart> {
+  private readonly fieldFormats: FieldFormatInstanceType[] = [
     DateFormat,
     DateNanosFormat,
     ...baseFormatters,
   ];
 
-  public setup() {
+  constructor(initializerContext: PluginInitializerContext) {}
+
+  public setup(core: CoreSetup) {
+    core.uiSettings.register(getUiSettings());
+
     return {
       register: (customFieldFormat: FieldFormatInstanceType) =>
-        this.fieldFormatClasses.push(customFieldFormat),
+        this.fieldFormats.push(customFieldFormat),
     };
   }
 
-  public start() {
+  public start(core: CoreStart) {
     return {
       fieldFormatServiceFactory: async (uiSettings: IUiSettingsClient) => {
         const fieldFormatsRegistry = new FieldFormatsRegistry();
@@ -43,16 +51,12 @@ export class FieldFormatsService {
           }
         });
 
-        fieldFormatsRegistry.init((key: string) => uiConfigs[key], {}, this.fieldFormatClasses);
+        fieldFormatsRegistry.init((key: string) => uiConfigs[key], {}, this.fieldFormats);
 
         return fieldFormatsRegistry;
       },
     };
   }
-}
 
-/** @public */
-export type FieldFormatsSetup = ReturnType<FieldFormatsService['setup']>;
-
-/** @public */
-export type FieldFormatsStart = ReturnType<FieldFormatsService['start']>;
+  public stop() {}
+}
diff --git a/src/plugins/field_formats/server/types.ts b/src/plugins/field_formats/server/types.ts
new file mode 100755
index 00000000000000..eaf9c9ffdc3909
--- /dev/null
+++ b/src/plugins/field_formats/server/types.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { FieldFormatInstanceType, FieldFormatsRegistry } from '../common';
+import { IUiSettingsClient } from '../../../core/server';
+
+export interface FieldFormatsSetup {
+  /**
+   * Register a server side field formatter
+   * @param fieldFormat {@link FieldFormatInstanceType}
+   */
+  register: (fieldFormat: FieldFormatInstanceType) => void;
+}
+
+export interface FieldFormatsStart {
+  /**
+   * Create a field format registry
+   * @param uiSettings - {@link IUiSettingsClient}
+   */
+  fieldFormatServiceFactory: (uiSettings: IUiSettingsClient) => Promise<FieldFormatsRegistry>;
+}
diff --git a/src/plugins/field_formats/server/ui_settings.ts b/src/plugins/field_formats/server/ui_settings.ts
new file mode 100644
index 00000000000000..f24ddc60e1f974
--- /dev/null
+++ b/src/plugins/field_formats/server/ui_settings.ts
@@ -0,0 +1,226 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { schema } from '@kbn/config-schema';
+import { UiSettingsParams } from 'kibana/server';
+// @ts-ignore untyped module
+import numeralLanguages from '@elastic/numeral/languages';
+import { FORMATS_UI_SETTINGS } from '../common';
+
+// We add the `en` key manually here, since that's not a real numeral locale, but the
+// default fallback in case the locale is not found.
+const numeralLanguageIds = [
+  'en',
+  ...numeralLanguages.map((numeralLanguage: any) => {
+    return numeralLanguage.id;
+  }),
+];
+
+export function getUiSettings(): Record<string, UiSettingsParams<unknown>> {
+  return {
+    [FORMATS_UI_SETTINGS.SHORT_DOTS_ENABLE]: {
+      name: i18n.translate('fieldFormats.advancedSettings.shortenFieldsTitle', {
+        defaultMessage: 'Shorten fields',
+      }),
+      value: false,
+      description: i18n.translate('fieldFormats.advancedSettings.shortenFieldsText', {
+        defaultMessage: 'Shorten long fields, for example, instead of foo.bar.baz, show f.b.baz',
+      }),
+      schema: schema.boolean(),
+    },
+    [FORMATS_UI_SETTINGS.FORMAT_DEFAULT_TYPE_MAP]: {
+      name: i18n.translate('fieldFormats.advancedSettings.format.defaultTypeMapTitle', {
+        defaultMessage: 'Field type format name',
+      }),
+      value: `{
+  "ip": { "id": "ip", "params": {} },
+  "date": { "id": "date", "params": {} },
+  "date_nanos": { "id": "date_nanos", "params": {}, "es": true },
+  "number": { "id": "number", "params": {} },
+  "boolean": { "id": "boolean", "params": {} },
+  "histogram": { "id": "histogram", "params": {} },
+  "_source": { "id": "_source", "params": {} },
+  "_default_": { "id": "string", "params": {} }
+}`,
+      type: 'json',
+      description: i18n.translate('fieldFormats.advancedSettings.format.defaultTypeMapText', {
+        defaultMessage:
+          'Map of the format name to use by default for each field type. ' +
+          '{defaultFormat} is used if the field type is not mentioned explicitly',
+        values: {
+          defaultFormat: '"_default_"',
+        },
+      }),
+      schema: schema.object({
+        ip: schema.object({
+          id: schema.string(),
+          params: schema.object({}),
+        }),
+        date: schema.object({
+          id: schema.string(),
+          params: schema.object({}),
+        }),
+        date_nanos: schema.object({
+          id: schema.string(),
+          params: schema.object({}),
+          es: schema.boolean(),
+        }),
+        number: schema.object({
+          id: schema.string(),
+          params: schema.object({}),
+        }),
+        boolean: schema.object({
+          id: schema.string(),
+          params: schema.object({}),
+        }),
+        histogram: schema.object({
+          id: schema.string(),
+          params: schema.object({}),
+        }),
+        _source: schema.object({
+          id: schema.string(),
+          params: schema.object({}),
+        }),
+        _default_: schema.object({
+          id: schema.string(),
+          params: schema.object({}),
+        }),
+      }),
+    },
+    [FORMATS_UI_SETTINGS.FORMAT_NUMBER_DEFAULT_PATTERN]: {
+      name: i18n.translate('fieldFormats.advancedSettings.format.numberFormatTitle', {
+        defaultMessage: 'Number format',
+      }),
+      value: '0,0.[000]',
+      type: 'string',
+      description: i18n.translate('fieldFormats.advancedSettings.format.numberFormatText', {
+        defaultMessage: 'Default {numeralFormatLink} for the "number" format',
+        description:
+          'Part of composite text: fieldFormats.advancedSettings.format.numberFormatText + ' +
+          'fieldFormats.advancedSettings.format.numberFormat.numeralFormatLinkText',
+        values: {
+          numeralFormatLink:
+            '<a href="https://www.elastic.co/guide/en/kibana/current/numeral.html" target="_blank" rel="noopener">' +
+            i18n.translate(
+              'fieldFormats.advancedSettings.format.numberFormat.numeralFormatLinkText',
+              {
+                defaultMessage: 'numeral format',
+              }
+            ) +
+            '</a>',
+        },
+      }),
+      schema: schema.string(),
+    },
+    [FORMATS_UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN]: {
+      name: i18n.translate('fieldFormats.advancedSettings.format.percentFormatTitle', {
+        defaultMessage: 'Percent format',
+      }),
+      value: '0,0.[000]%',
+      type: 'string',
+      description: i18n.translate('fieldFormats.advancedSettings.format.percentFormatText', {
+        defaultMessage: 'Default {numeralFormatLink} for the "percent" format',
+        description:
+          'Part of composite text: fieldFormats.advancedSettings.format.percentFormatText + ' +
+          'fieldFormats.advancedSettings.format.percentFormat.numeralFormatLinkText',
+        values: {
+          numeralFormatLink:
+            '<a href="https://www.elastic.co/guide/en/kibana/current/numeral.html" target="_blank" rel="noopener">' +
+            i18n.translate(
+              'fieldFormats.advancedSettings.format.percentFormat.numeralFormatLinkText',
+              {
+                defaultMessage: 'numeral format',
+              }
+            ) +
+            '</a>',
+        },
+      }),
+      schema: schema.string(),
+    },
+    [FORMATS_UI_SETTINGS.FORMAT_BYTES_DEFAULT_PATTERN]: {
+      name: i18n.translate('fieldFormats.advancedSettings.format.bytesFormatTitle', {
+        defaultMessage: 'Bytes format',
+      }),
+      value: '0,0.[0]b',
+      type: 'string',
+      description: i18n.translate('fieldFormats.advancedSettings.format.bytesFormatText', {
+        defaultMessage: 'Default {numeralFormatLink} for the "bytes" format',
+        description:
+          'Part of composite text: fieldFormats.advancedSettings.format.bytesFormatText + ' +
+          'fieldFormats.advancedSettings.format.bytesFormat.numeralFormatLinkText',
+        values: {
+          numeralFormatLink:
+            '<a href="https://www.elastic.co/guide/en/kibana/current/numeral.html" target="_blank" rel="noopener">' +
+            i18n.translate(
+              'fieldFormats.advancedSettings.format.bytesFormat.numeralFormatLinkText',
+              {
+                defaultMessage: 'numeral format',
+              }
+            ) +
+            '</a>',
+        },
+      }),
+      schema: schema.string(),
+    },
+    [FORMATS_UI_SETTINGS.FORMAT_CURRENCY_DEFAULT_PATTERN]: {
+      name: i18n.translate('fieldFormats.advancedSettings.format.currencyFormatTitle', {
+        defaultMessage: 'Currency format',
+      }),
+      value: '($0,0.[00])',
+      type: 'string',
+      description: i18n.translate('fieldFormats.advancedSettings.format.currencyFormatText', {
+        defaultMessage: 'Default {numeralFormatLink} for the "currency" format',
+        description:
+          'Part of composite text: fieldFormats.advancedSettings.format.currencyFormatText + ' +
+          'fieldFormats.advancedSettings.format.currencyFormat.numeralFormatLinkText',
+        values: {
+          numeralFormatLink:
+            '<a href="https://www.elastic.co/guide/en/kibana/current/numeral.html" target="_blank" rel="noopener">' +
+            i18n.translate(
+              'fieldFormats.advancedSettings.format.currencyFormat.numeralFormatLinkText',
+              {
+                defaultMessage: 'numeral format',
+              }
+            ) +
+            '</a>',
+        },
+      }),
+      schema: schema.string(),
+    },
+    [FORMATS_UI_SETTINGS.FORMAT_NUMBER_DEFAULT_LOCALE]: {
+      name: i18n.translate('fieldFormats.advancedSettings.format.formattingLocaleTitle', {
+        defaultMessage: 'Formatting locale',
+      }),
+      value: 'en',
+      type: 'select',
+      options: numeralLanguageIds,
+      optionLabels: Object.fromEntries(
+        numeralLanguages.map((language: Record<string, any>) => [language.id, language.name])
+      ),
+      description: i18n.translate('fieldFormats.advancedSettings.format.formattingLocaleText', {
+        defaultMessage: `{numeralLanguageLink} locale`,
+        description:
+          'Part of composite text: fieldFormats.advancedSettings.format.formattingLocale.numeralLanguageLinkText + ' +
+          'fieldFormats.advancedSettings.format.formattingLocaleText',
+        values: {
+          numeralLanguageLink:
+            '<a href="https://www.elastic.co/guide/en/kibana/current/numeral.html" target="_blank" rel="noopener">' +
+            i18n.translate(
+              'fieldFormats.advancedSettings.format.formattingLocale.numeralLanguageLinkText',
+              {
+                defaultMessage: 'Numeral language',
+              }
+            ) +
+            '</a>',
+        },
+      }),
+      schema: schema.string(),
+    },
+  };
+}
diff --git a/src/plugins/field_formats/tsconfig.json b/src/plugins/field_formats/tsconfig.json
new file mode 100644
index 00000000000000..4382ab1051c1d6
--- /dev/null
+++ b/src/plugins/field_formats/tsconfig.json
@@ -0,0 +1,19 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "outDir": "./target/types",
+    "emitDeclarationOnly": true,
+    "declaration": true,
+    "declarationMap": true
+  },
+  "include": [
+    "common/**/*",
+    "public/**/*",
+    "server/**/*",
+    "config.ts",
+    "common/**/*.json",
+    "public/**/*.json"
+  ],
+  "references": [{ "path": "../../core/tsconfig.json" }]
+}
diff --git a/src/plugins/index_pattern_editor/README.md b/src/plugins/index_pattern_editor/README.md
new file mode 100644
index 00000000000000..3ffb5892307323
--- /dev/null
+++ b/src/plugins/index_pattern_editor/README.md
@@ -0,0 +1,48 @@
+# Index pattern editor
+
+Create index patterns from within Kibana apps. 
+
+## How to use
+
+You first need to add in your kibana.json the "`indexPatternEditor`" plugin as a required dependency of your plugin.
+
+You will then receive in the start contract of the indexPatternEditor plugin the following API:
+
+### `userPermissions.editIndexPattern(): boolean`
+
+Convenience method that uses the `core.application.capabilities` api to determine whether the user can create or edit the index pattern. 
+
+### `openEditor(options: IndexPatternEditorProps): CloseEditor`
+
+Use this method to display the index pattern editor to create an index pattern.  
+
+#### `options`
+
+`onSave: (indexPattern: IndexPattern) => void` (**required**)
+
+You must provide an `onSave` handler to be notified when an index pattern has been created/updated. This handler is called after the index pattern has been persisted as a saved object.
+
+`onCancel: () => void;` (optional)
+
+You can optionally pass an `onCancel` handler which is called when the index pattern creation flyout is closed wihtout creating an index pattern.
+
+`defaultTypeIsRollup: boolean` (optional, default false)
+
+The default index pattern type can be optionally specified as `rollup`.
+
+`requireTimestampField: boolean` (optional, default false)
+
+The editor can require a timestamp field on the index pattern.
+
+### IndexPatternEditorComponent
+
+This the React component interface equivalent to `openEditor`. It takes the same arguments -
+
+```tsx
+<IndexPatternEditorComponent
+  onSave={...}
+  onCancel={...}
+  defaultTypeIsRollup={false}
+  requireTimestampField={false}
+/>
+```
diff --git a/src/plugins/index_pattern_editor/jest.config.js b/src/plugins/index_pattern_editor/jest.config.js
new file mode 100644
index 00000000000000..0a018a42d06e6b
--- /dev/null
+++ b/src/plugins/index_pattern_editor/jest.config.js
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test',
+  rootDir: '../../..',
+  roots: ['<rootDir>/src/plugins/index_pattern_editor'],
+};
diff --git a/src/plugins/index_pattern_editor/kibana.json b/src/plugins/index_pattern_editor/kibana.json
new file mode 100644
index 00000000000000..b4a1bea5556163
--- /dev/null
+++ b/src/plugins/index_pattern_editor/kibana.json
@@ -0,0 +1,13 @@
+{
+  "id": "indexPatternEditor",
+  "version": "kibana",
+  "server": false,
+  "ui": true,
+  "requiredPlugins": ["data"],
+  "requiredBundles": ["kibanaReact", "esUiShared"],
+  "owner": {
+    "name": "App Services",
+    "githubTeam": "kibana-app-services"
+  },
+  "description": "This plugin provides the ability to create index patterns via a modal flyout from any kibana app"
+}
diff --git a/src/plugins/index_pattern_editor/public/components/_templates.scss b/src/plugins/index_pattern_editor/public/components/_templates.scss
new file mode 100644
index 00000000000000..5303537bddabcb
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/_templates.scss
@@ -0,0 +1,11 @@
+%inp-empty-state-footer {
+  background: $euiColorLightestShade;
+  margin: 0 (-$euiSizeL) (-$euiSizeL);
+  padding: $euiSizeL;
+  border-radius: 0 0 $euiBorderRadius $euiBorderRadius;
+
+  // sass-lint:disable-block mixins-before-declarations
+  @include euiBreakpoint('xs', 's') {
+    text-align: center;
+  }
+}
diff --git a/src/plugins/index_pattern_editor/public/components/_variables.scss b/src/plugins/index_pattern_editor/public/components/_variables.scss
new file mode 100644
index 00000000000000..5da25a91bd77c5
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/_variables.scss
@@ -0,0 +1 @@
+$inpEmptyStateMaxWidth: $euiSizeXXL * 19;
diff --git a/src/plugins/index_pattern_editor/public/components/advanced_params_content/advanced_params_content.tsx b/src/plugins/index_pattern_editor/public/components/advanced_params_content/advanced_params_content.tsx
new file mode 100644
index 00000000000000..ad876fed518017
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/advanced_params_content/advanced_params_content.tsx
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiFlexGroup, EuiFlexItem, EuiSpacer } from '@elastic/eui';
+
+import { UseField, TextField, ToggleField } from '../../shared_imports';
+import { IndexPatternConfig } from '../../types';
+
+import { AdvancedParamsSection } from './advanced_params_section';
+
+const allowHiddenAriaLabel = i18n.translate('indexPatternEditor.form.allowHiddenAriaLabel', {
+  defaultMessage: 'Allow hidden and system indices',
+});
+
+const customIndexPatternIdLabel = i18n.translate(
+  'indexPatternEditor.form.customIndexPatternIdLabel',
+  {
+    defaultMessage: 'Custom index pattern ID',
+  }
+);
+
+interface AdvancedParamsContentProps {
+  disableAllowHidden: boolean;
+}
+
+export const AdvancedParamsContent = ({ disableAllowHidden }: AdvancedParamsContentProps) => (
+  <AdvancedParamsSection>
+    <EuiFlexGroup>
+      <EuiFlexItem>
+        <UseField<boolean, IndexPatternConfig>
+          path={'allowHidden'}
+          component={ToggleField}
+          data-test-subj="allowHiddenField"
+          componentProps={{
+            euiFieldProps: {
+              'aria-label': allowHiddenAriaLabel,
+              disabled: disableAllowHidden,
+            },
+          }}
+        />
+      </EuiFlexItem>
+    </EuiFlexGroup>
+    <EuiSpacer size="m" />
+    <EuiFlexGroup>
+      <EuiFlexItem>
+        <UseField<string, IndexPatternConfig>
+          path={'id'}
+          component={TextField}
+          data-test-subj="savedObjectIdField"
+          componentProps={{
+            euiFieldProps: {
+              'aria-label': customIndexPatternIdLabel,
+            },
+          }}
+        />
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  </AdvancedParamsSection>
+);
diff --git a/src/plugins/index_pattern_editor/public/components/advanced_params_content/advanced_params_section.tsx b/src/plugins/index_pattern_editor/public/components/advanced_params_content/advanced_params_section.tsx
new file mode 100644
index 00000000000000..b313fddb8ee2d8
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/advanced_params_content/advanced_params_section.tsx
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React, { useState, useCallback } from 'react';
+import { i18n } from '@kbn/i18n';
+
+import { EuiButtonEmpty, EuiSpacer } from '@elastic/eui';
+
+interface Props {
+  children: React.ReactNode;
+}
+
+export const AdvancedParamsSection = ({ children }: Props) => {
+  const [isVisible, setIsVisible] = useState<boolean>(false);
+
+  const toggleIsVisible = useCallback(() => {
+    setIsVisible(!isVisible);
+  }, [isVisible]);
+
+  return (
+    <>
+      <EuiButtonEmpty onClick={toggleIsVisible} flush="left" data-test-subj="toggleAdvancedSetting">
+        {isVisible
+          ? i18n.translate('indexPatternEditor.editor.form.advancedSettings.hideButtonLabel', {
+              defaultMessage: 'Hide advanced settings',
+            })
+          : i18n.translate('indexPatternEditor.editor.form.advancedSettings.showButtonLabel', {
+              defaultMessage: 'Show advanced settings',
+            })}
+      </EuiButtonEmpty>
+
+      <div style={{ display: isVisible ? 'block' : 'none' }} data-test-subj="advancedSettings">
+        <EuiSpacer size="m" />
+        {/* We ned to wrap the children inside a "div" to have our css :first-child rule */}
+        <div>{children}</div>
+      </div>
+    </>
+  );
+};
diff --git a/src/plugins/index_pattern_editor/public/components/advanced_params_content/index.ts b/src/plugins/index_pattern_editor/public/components/advanced_params_content/index.ts
new file mode 100644
index 00000000000000..a285004d1f45d9
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/advanced_params_content/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { AdvancedParamsContent } from './advanced_params_content';
diff --git a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_state/__snapshots__/empty_state.test.tsx.snap b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_list_prompt/__snapshots__/empty_index_list_prompt.test.tsx.snap
similarity index 71%
rename from src/plugins/index_pattern_management/public/components/index_pattern_table/empty_state/__snapshots__/empty_state.test.tsx.snap
rename to src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_list_prompt/__snapshots__/empty_index_list_prompt.test.tsx.snap
index 75b8177d9dac35..a104c36e3a8a09 100644
--- a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_state/__snapshots__/empty_state.test.tsx.snap
+++ b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_list_prompt/__snapshots__/empty_index_list_prompt.test.tsx.snap
@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`EmptyState should render normally 1`] = `
+exports[`EmptyIndexListPrompt should render normally 1`] = `
 <Fragment>
   <EuiPageContent
     className="inpEmptyState"
@@ -16,7 +16,7 @@ exports[`EmptyState should render normally 1`] = `
           <h2>
             <FormattedMessage
               defaultMessage="Ready to try Kibana? First, you need data."
-              id="indexPatternManagement.createIndexPattern.emptyState.noDataTitle"
+              id="indexPatternEditor.createIndexPattern.emptyState.noDataTitle"
               values={Object {}}
             />
           </h2>
@@ -38,7 +38,7 @@ exports[`EmptyState should render normally 1`] = `
             description={
               <FormattedMessage
                 defaultMessage="Add data from a variety of sources."
-                id="indexPatternManagement.createIndexPattern.emptyState.integrationCardDescription"
+                id="indexPatternEditor.createIndexPattern.emptyState.integrationCardDescription"
                 values={Object {}}
               />
             }
@@ -53,7 +53,7 @@ exports[`EmptyState should render normally 1`] = `
             title={
               <FormattedMessage
                 defaultMessage="Add integration"
-                id="indexPatternManagement.createIndexPattern.emptyState.integrationCardTitle"
+                id="indexPatternEditor.createIndexPattern.emptyState.integrationCardTitle"
                 values={Object {}}
               />
             }
@@ -65,7 +65,7 @@ exports[`EmptyState should render normally 1`] = `
             description={
               <FormattedMessage
                 defaultMessage="Import a CSV, NDJSON, or log file."
-                id="indexPatternManagement.createIndexPattern.emptyState.uploadCardDescription"
+                id="indexPatternEditor.createIndexPattern.emptyState.uploadCardDescription"
                 values={Object {}}
               />
             }
@@ -80,7 +80,7 @@ exports[`EmptyState should render normally 1`] = `
             title={
               <FormattedMessage
                 defaultMessage="Upload a file"
-                id="indexPatternManagement.createIndexPattern.emptyState.uploadCardTitle"
+                id="indexPatternEditor.createIndexPattern.emptyState.uploadCardTitle"
                 values={Object {}}
               />
             }
@@ -92,7 +92,7 @@ exports[`EmptyState should render normally 1`] = `
             description={
               <FormattedMessage
                 defaultMessage="Load a data set and a Kibana dashboard."
-                id="indexPatternManagement.createIndexPattern.emptyState.sampleDataCardDescription"
+                id="indexPatternEditor.createIndexPattern.emptyState.sampleDataCardDescription"
                 values={Object {}}
               />
             }
@@ -107,7 +107,7 @@ exports[`EmptyState should render normally 1`] = `
             title={
               <FormattedMessage
                 defaultMessage="Add sample data"
-                id="indexPatternManagement.createIndexPattern.emptyState.sampleDataCardTitle"
+                id="indexPatternEditor.createIndexPattern.emptyState.sampleDataCardTitle"
                 values={Object {}}
               />
             }
@@ -131,18 +131,18 @@ exports[`EmptyState should render normally 1`] = `
                   Object {
                     "description": <EuiLink
                       external={true}
-                      href="https://www.elastic.co/guide/en/kibana/mocked-test-branch/connect-to-elasticsearch.html"
+                      href="http://elastic.co"
                       target="_blank"
                     >
                       <FormattedMessage
                         defaultMessage="Read documentation"
-                        id="indexPatternManagement.createIndexPattern.emptyState.readDocs"
+                        id="indexPatternEditor.createIndexPattern.emptyState.readDocs"
                         values={Object {}}
                       />
                     </EuiLink>,
                     "title": <FormattedMessage
                       defaultMessage="Want to learn more?"
-                      id="indexPatternManagement.createIndexPattern.emptyState.learnMore"
+                      id="indexPatternEditor.createIndexPattern.emptyState.learnMore"
                       values={Object {}}
                     />,
                   },
@@ -164,7 +164,7 @@ exports[`EmptyState should render normally 1`] = `
                     >
                       <FormattedMessage
                         defaultMessage="Check for new data"
-                        id="indexPatternManagement.createIndexPattern.emptyState.checkDataButton"
+                        id="indexPatternEditor.createIndexPattern.emptyState.checkDataButton"
                         values={Object {}}
                       />
                        
@@ -175,7 +175,7 @@ exports[`EmptyState should render normally 1`] = `
                     </EuiLink>,
                     "title": <FormattedMessage
                       defaultMessage="Think you already have data?"
-                      id="indexPatternManagement.createIndexPattern.emptyState.haveData"
+                      id="indexPatternEditor.createIndexPattern.emptyState.haveData"
                       values={Object {}}
                     />,
                   },
@@ -184,33 +184,33 @@ exports[`EmptyState should render normally 1`] = `
             />
           </EuiFlexItem>
         </EuiFlexGroup>
+        <EuiSpacer />
+        <EuiText
+          color="subdued"
+          size="xs"
+          textAlign="center"
+        >
+          <FormattedMessage
+            defaultMessage="Some indices may be hidden. Try to {link} anyway."
+            id="indexPatternEditor.createIndexPattern.emptyState.createAnyway"
+            values={
+              Object {
+                "link": <EuiLink
+                  data-test-subj="createAnyway"
+                  onClick={[Function]}
+                >
+                  <FormattedMessage
+                    defaultMessage="create an index pattern"
+                    id="indexPatternEditor.createIndexPattern.emptyState.createAnywayLink"
+                    values={Object {}}
+                  />
+                </EuiLink>,
+              }
+            }
+          />
+        </EuiText>
       </div>
     </EuiPageContentBody>
   </EuiPageContent>
-  <EuiSpacer />
-  <EuiText
-    color="subdued"
-    size="xs"
-    textAlign="center"
-  >
-    <FormattedMessage
-      defaultMessage="Some indices may be hidden. Try to {link} anyway."
-      id="indexPatternManagement.createIndexPattern.emptyState.createAnyway"
-      values={
-        Object {
-          "link": <EuiLink
-            data-test-subj="createAnyway"
-            onClick={[Function]}
-          >
-            <FormattedMessage
-              defaultMessage="create an index pattern"
-              id="indexPatternManagement.createIndexPattern.emptyState.createAnywayLink"
-              values={Object {}}
-            />
-          </EuiLink>,
-        }
-      }
-    />
-  </EuiText>
 </Fragment>
 `;
diff --git a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_state/empty_state.scss b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_list_prompt/empty_index_list_prompt.scss
similarity index 86%
rename from src/plugins/index_pattern_management/public/components/index_pattern_table/empty_state/empty_state.scss
rename to src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_list_prompt/empty_index_list_prompt.scss
index 37889b9d7c4834..845ddfb3eb234a 100644
--- a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_state/empty_state.scss
+++ b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_list_prompt/empty_index_list_prompt.scss
@@ -1,5 +1,5 @@
-@import '../../../variables';
-@import '../../../templates';
+@import '../../variables';
+@import '../../templates';
 
 .inpEmptyState {
   // override EUI specificity
diff --git a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_state/empty_state.test.tsx b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_list_prompt/empty_index_list_prompt.test.tsx
similarity index 69%
rename from src/plugins/index_pattern_management/public/components/index_pattern_table/empty_state/empty_state.test.tsx
rename to src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_list_prompt/empty_index_list_prompt.test.tsx
index ed68d4d4ddd646..f5a996a4415152 100644
--- a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_state/empty_state.test.tsx
+++ b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_list_prompt/empty_index_list_prompt.test.tsx
@@ -7,14 +7,11 @@
  */
 
 import React from 'react';
-import { EmptyState } from '../empty_state';
+import { EmptyIndexListPrompt } from './empty_index_list_prompt';
 import { shallow } from 'enzyme';
 import sinon from 'sinon';
 import { findTestSubject } from '@elastic/eui/lib/test';
 import { mountWithIntl } from '@kbn/test/jest';
-import { docLinksServiceMock } from '../../../../../../core/public/mocks';
-
-const docLinks = docLinksServiceMock.createStartContract();
 
 jest.mock('react-router-dom', () => ({
   useHistory: () => ({
@@ -22,14 +19,16 @@ jest.mock('react-router-dom', () => ({
   }),
 }));
 
-describe('EmptyState', () => {
+describe('EmptyIndexListPrompt', () => {
   it('should render normally', () => {
     const component = shallow(
-      <EmptyState
-        docLinks={docLinks}
+      <EmptyIndexListPrompt
         onRefresh={() => {}}
-        navigateToApp={async () => {}}
-        canSave={true}
+        createAnyway={() => {}}
+        closeFlyout={() => {}}
+        addDataUrl={'http://elastic.co'}
+        navigateToApp={async (appId) => {}}
+        canSaveIndexPattern={true}
       />
     );
 
@@ -42,11 +41,13 @@ describe('EmptyState', () => {
         const onRefreshHandler = sinon.stub();
 
         const component = mountWithIntl(
-          <EmptyState
-            docLinks={docLinks}
+          <EmptyIndexListPrompt
             onRefresh={onRefreshHandler}
-            navigateToApp={async () => {}}
-            canSave={true}
+            createAnyway={() => {}}
+            closeFlyout={() => {}}
+            addDataUrl={'http://elastic.co'}
+            navigateToApp={async (appId) => {}}
+            canSaveIndexPattern={true}
           />
         );
 
diff --git a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_state/empty_state.tsx b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_list_prompt/empty_index_list_prompt.tsx
similarity index 72%
rename from src/plugins/index_pattern_management/public/components/index_pattern_table/empty_state/empty_state.tsx
rename to src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_list_prompt/empty_index_list_prompt.tsx
index af49e8c36fe3bd..1331eb9b7c4aca 100644
--- a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_state/empty_state.tsx
+++ b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_list_prompt/empty_index_list_prompt.tsx
@@ -6,10 +6,9 @@
  * Side Public License, v 1.
  */
 
-import './empty_state.scss';
+import './empty_index_list_prompt.scss';
 import React from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { DocLinksStart, ApplicationStart } from 'kibana/public';
 import {
   EuiPageContentHeader,
   EuiPageContentHeaderSection,
@@ -26,30 +25,34 @@ import {
   EuiText,
   EuiFlexGroup,
 } from '@elastic/eui';
-import { useHistory } from 'react-router-dom';
-import { reactRouterNavigate } from '../../../../../../plugins/kibana_react/public';
 
-export const EmptyState = ({
+import { ApplicationStart } from 'src/core/public';
+
+export const EmptyIndexListPrompt = ({
   onRefresh,
+  closeFlyout,
+  createAnyway,
+  canSaveIndexPattern,
+  addDataUrl,
   navigateToApp,
-  docLinks,
-  canSave,
 }: {
   onRefresh: () => void;
+  closeFlyout: () => void;
+  createAnyway: () => void;
+  canSaveIndexPattern: boolean;
+  addDataUrl: string;
   navigateToApp: ApplicationStart['navigateToApp'];
-  docLinks: DocLinksStart;
-  canSave: boolean;
 }) => {
-  const createAnyway = (
+  const createAnywayLink = (
     <EuiText color="subdued" textAlign="center" size="xs">
       <FormattedMessage
-        id="indexPatternManagement.createIndexPattern.emptyState.createAnyway"
+        id="indexPatternEditor.createIndexPattern.emptyState.createAnyway"
         defaultMessage="Some indices may be hidden. Try to {link} anyway."
         values={{
           link: (
-            <EuiLink {...reactRouterNavigate(useHistory(), 'create')} data-test-subj="createAnyway">
+            <EuiLink onClick={() => createAnyway()} data-test-subj="createAnyway">
               <FormattedMessage
-                id="indexPatternManagement.createIndexPattern.emptyState.createAnywayLink"
+                id="indexPatternEditor.createIndexPattern.emptyState.createAnywayLink"
                 defaultMessage="create an index pattern"
               />
             </EuiLink>
@@ -74,7 +77,7 @@ export const EmptyState = ({
             <EuiTitle>
               <h2>
                 <FormattedMessage
-                  id="indexPatternManagement.createIndexPattern.emptyState.noDataTitle"
+                  id="indexPatternEditor.createIndexPattern.emptyState.noDataTitle"
                   defaultMessage="Ready to try Kibana? First, you need data."
                 />
               </h2>
@@ -87,17 +90,20 @@ export const EmptyState = ({
             <EuiFlexItem>
               <EuiCard
                 className="inpEmptyState__card"
-                onClick={() => navigateToApp('home', { path: '#/tutorial_directory' })}
+                onClick={() => {
+                  navigateToApp('home', { path: '#/tutorial_directory' });
+                  closeFlyout();
+                }}
                 icon={<EuiIcon size="xl" type="database" color="subdued" />}
                 title={
                   <FormattedMessage
-                    id="indexPatternManagement.createIndexPattern.emptyState.integrationCardTitle"
+                    id="indexPatternEditor.createIndexPattern.emptyState.integrationCardTitle"
                     defaultMessage="Add integration"
                   />
                 }
                 description={
                   <FormattedMessage
-                    id="indexPatternManagement.createIndexPattern.emptyState.integrationCardDescription"
+                    id="indexPatternEditor.createIndexPattern.emptyState.integrationCardDescription"
                     defaultMessage="Add data from a variety of sources."
                   />
                 }
@@ -110,13 +116,13 @@ export const EmptyState = ({
                 icon={<EuiIcon size="xl" type="document" color="subdued" />}
                 title={
                   <FormattedMessage
-                    id="indexPatternManagement.createIndexPattern.emptyState.uploadCardTitle"
+                    id="indexPatternEditor.createIndexPattern.emptyState.uploadCardTitle"
                     defaultMessage="Upload a file"
                   />
                 }
                 description={
                   <FormattedMessage
-                    id="indexPatternManagement.createIndexPattern.emptyState.uploadCardDescription"
+                    id="indexPatternEditor.createIndexPattern.emptyState.uploadCardDescription"
                     defaultMessage="Import a CSV, NDJSON, or log file."
                   />
                 }
@@ -125,17 +131,20 @@ export const EmptyState = ({
             <EuiFlexItem>
               <EuiCard
                 className="inpEmptyState__card"
-                onClick={() => navigateToApp('home', { path: '#/tutorial_directory/sampleData' })}
+                onClick={() => {
+                  navigateToApp('home', { path: '#/tutorial_directory/sampleData' });
+                  closeFlyout();
+                }}
                 icon={<EuiIcon size="xl" type="heatmap" color="subdued" />}
                 title={
                   <FormattedMessage
-                    id="indexPatternManagement.createIndexPattern.emptyState.sampleDataCardTitle"
+                    id="indexPatternEditor.createIndexPattern.emptyState.sampleDataCardTitle"
                     defaultMessage="Add sample data"
                   />
                 }
                 description={
                   <FormattedMessage
-                    id="indexPatternManagement.createIndexPattern.emptyState.sampleDataCardDescription"
+                    id="indexPatternEditor.createIndexPattern.emptyState.sampleDataCardDescription"
                     defaultMessage="Load a data set and a Kibana dashboard."
                   />
                 }
@@ -151,14 +160,14 @@ export const EmptyState = ({
                     {
                       title: (
                         <FormattedMessage
-                          id="indexPatternManagement.createIndexPattern.emptyState.learnMore"
+                          id="indexPatternEditor.createIndexPattern.emptyState.learnMore"
                           defaultMessage="Want to learn more?"
                         />
                       ),
                       description: (
-                        <EuiLink href={docLinks.links.addData} target="_blank" external>
+                        <EuiLink href={addDataUrl} target="_blank" external>
                           <FormattedMessage
-                            id="indexPatternManagement.createIndexPattern.emptyState.readDocs"
+                            id="indexPatternEditor.createIndexPattern.emptyState.readDocs"
                             defaultMessage="Read documentation"
                           />
                         </EuiLink>
@@ -173,14 +182,14 @@ export const EmptyState = ({
                     {
                       title: (
                         <FormattedMessage
-                          id="indexPatternManagement.createIndexPattern.emptyState.haveData"
+                          id="indexPatternEditor.createIndexPattern.emptyState.haveData"
                           defaultMessage="Think you already have data?"
                         />
                       ),
                       description: (
                         <EuiLink onClick={onRefresh} data-test-subj="refreshIndicesButton">
                           <FormattedMessage
-                            id="indexPatternManagement.createIndexPattern.emptyState.checkDataButton"
+                            id="indexPatternEditor.createIndexPattern.emptyState.checkDataButton"
                             defaultMessage="Check for new data"
                           />{' '}
                           <EuiIcon type="refresh" size="s" />
@@ -191,11 +200,11 @@ export const EmptyState = ({
                 />
               </EuiFlexItem>
             </EuiFlexGroup>
+            <EuiSpacer />
+            {canSaveIndexPattern && createAnywayLink}
           </div>
         </EuiPageContentBody>
       </EuiPageContent>
-      <EuiSpacer />
-      {canSave && createAnyway}
     </>
   );
 };
diff --git a/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_list_prompt/index.ts b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_list_prompt/index.ts
new file mode 100644
index 00000000000000..ae5dcecf069c73
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_list_prompt/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { EmptyIndexListPrompt } from './empty_index_list_prompt';
diff --git a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_index_pattern_prompt/__snapshots__/empty_index_pattern_prompt.test.tsx.snap b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_pattern_prompt/__snapshots__/empty_index_pattern_prompt.test.tsx.snap
similarity index 66%
rename from src/plugins/index_pattern_management/public/components/index_pattern_table/empty_index_pattern_prompt/__snapshots__/empty_index_pattern_prompt.test.tsx.snap
rename to src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_pattern_prompt/__snapshots__/empty_index_pattern_prompt.test.tsx.snap
index bc69fa29e69044..6216f04c0a1a94 100644
--- a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_index_pattern_prompt/__snapshots__/empty_index_pattern_prompt.test.tsx.snap
+++ b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_pattern_prompt/__snapshots__/empty_index_pattern_prompt.test.tsx.snap
@@ -19,7 +19,15 @@ exports[`EmptyIndexPatternPrompt should render normally 1`] = `
       className="inpEmptyIndexPatternPrompt__illustration"
       grow={1}
     >
-      <IndexPatternIllustration />
+      <Suspense
+        fallback={
+          <EuiLoadingSpinner
+            size="xl"
+          />
+        }
+      >
+        <lazy />
+      </Suspense>
     </EuiFlexItem>
     <EuiFlexItem
       className="inpEmptyIndexPatternPrompt__text"
@@ -31,39 +39,35 @@ exports[`EmptyIndexPatternPrompt should render normally 1`] = `
         <h2>
           <FormattedMessage
             defaultMessage="You have data in Elasticsearch."
-            id="indexPatternManagement.emptyIndexPatternPrompt.youHaveData"
+            id="indexPatternEditor.emptyIndexPatternPrompt.youHaveData"
             values={Object {}}
           />
           <br />
           <FormattedMessage
             defaultMessage="Now, create an index pattern."
-            id="indexPatternManagement.emptyIndexPatternPrompt.nowCreate"
+            id="indexPatternEditor.emptyIndexPatternPrompt.nowCreate"
             values={Object {}}
           />
         </h2>
         <p>
           <FormattedMessage
-            defaultMessage="Kibana requires an index pattern to identify which indices you want to explore. An index pattern can point to a specific index, for example, your log data from yesterday, or all indices that contain your log data."
-            id="indexPatternManagement.emptyIndexPatternPrompt.indexPatternExplanation"
+            defaultMessage="Kibana requires an index pattern to identify which data streams, indices, and  aliases you want to explore. An index pattern can point to a specific index, for example, your log data from yesterday, or all indices that contain your log data."
+            id="indexPatternEditor.emptyIndexPatternPrompt.indexPatternExplanation"
             values={Object {}}
           />
         </p>
-        <CreateButton
-          options={
-            Array [
-              Object {
-                "onClick": [Function],
-                "text": "default",
-              },
-            ]
-          }
+        <EuiButton
+          data-test-subj="createIndexPatternButtonFlyout"
+          fill={true}
+          iconType="plusInCircle"
+          onClick={[Function]}
         >
           <FormattedMessage
             defaultMessage="Create index pattern"
-            id="indexPatternManagement.indexPatternTable.createBtn"
+            id="indexPatternEditor.indexPatternTable.createBtn"
             values={Object {}}
           />
-        </CreateButton>
+        </EuiButton>
       </EuiText>
     </EuiFlexItem>
   </EuiFlexGroup>
@@ -79,19 +83,19 @@ exports[`EmptyIndexPatternPrompt should render normally 1`] = `
     >
       <FormattedMessage
         defaultMessage="Want to learn more?"
-        id="indexPatternManagement.emptyIndexPatternPrompt.learnMore"
+        id="indexPatternEditor.emptyIndexPatternPrompt.learnMore"
         values={Object {}}
       />
     </EuiDescriptionListTitle>
     <EuiDescriptionListDescription>
       <EuiLink
         external={true}
-        href="testUrl"
+        href="http://elastic.co/"
         target="_blank"
       >
         <FormattedMessage
           defaultMessage="Read documentation"
-          id="indexPatternManagement.emptyIndexPatternPrompt.documentation"
+          id="indexPatternEditor.emptyIndexPatternPrompt.documentation"
           values={Object {}}
         />
       </EuiLink>
diff --git a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_index_pattern_prompt/assets/index_pattern_illustration.scss b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_pattern_prompt/assets/index_pattern_illustration.scss
similarity index 100%
rename from src/plugins/index_pattern_management/public/components/index_pattern_table/empty_index_pattern_prompt/assets/index_pattern_illustration.scss
rename to src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_pattern_prompt/assets/index_pattern_illustration.scss
diff --git a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_index_pattern_prompt/assets/index_pattern_illustration.tsx b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_pattern_prompt/assets/index_pattern_illustration.tsx
similarity index 99%
rename from src/plugins/index_pattern_management/public/components/index_pattern_table/empty_index_pattern_prompt/assets/index_pattern_illustration.tsx
rename to src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_pattern_prompt/assets/index_pattern_illustration.tsx
index 3666c1be7b5d2c..09b18e25e9d004 100644
--- a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_index_pattern_prompt/assets/index_pattern_illustration.tsx
+++ b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_pattern_prompt/assets/index_pattern_illustration.tsx
@@ -537,4 +537,5 @@ const IndexPatternIllustration = () => (
   </svg>
 );
 
-export const Illustration = IndexPatternIllustration;
+/* eslint-disable import/no-default-export */
+export default IndexPatternIllustration;
diff --git a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_index_pattern_prompt/empty_index_pattern_prompt.scss b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_pattern_prompt/empty_index_pattern_prompt.scss
similarity index 92%
rename from src/plugins/index_pattern_management/public/components/index_pattern_table/empty_index_pattern_prompt/empty_index_pattern_prompt.scss
rename to src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_pattern_prompt/empty_index_pattern_prompt.scss
index 11ac55b098a57c..f6db2fc89f353a 100644
--- a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_index_pattern_prompt/empty_index_pattern_prompt.scss
+++ b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_pattern_prompt/empty_index_pattern_prompt.scss
@@ -1,5 +1,5 @@
-@import '../../../variables';
-@import '../../../templates';
+@import '../../variables';
+@import '../../templates';
 
 .inpEmptyIndexPatternPrompt {
   // override EUI specificity
diff --git a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_index_pattern_prompt/empty_index_pattern_prompt.test.tsx b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_pattern_prompt/empty_index_pattern_prompt.test.tsx
similarity index 82%
rename from src/plugins/index_pattern_management/public/components/index_pattern_table/empty_index_pattern_prompt/empty_index_pattern_prompt.test.tsx
rename to src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_pattern_prompt/empty_index_pattern_prompt.test.tsx
index 1cd0574a35d15b..4cf3c4b55acded 100644
--- a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_index_pattern_prompt/empty_index_pattern_prompt.test.tsx
+++ b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_pattern_prompt/empty_index_pattern_prompt.test.tsx
@@ -14,10 +14,9 @@ describe('EmptyIndexPatternPrompt', () => {
   it('should render normally', () => {
     const component = shallowWithI18nProvider(
       <EmptyIndexPatternPrompt
-        canSave
-        creationOptions={[{ text: 'default', onClick: () => {} }]}
-        docLinksIndexPatternIntro={'testUrl'}
-        setBreadcrumbs={() => {}}
+        goToCreate={() => {}}
+        canSaveIndexPattern={true}
+        indexPatternsIntroUrl={'http://elastic.co/'}
       />
     );
 
diff --git a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_index_pattern_prompt/empty_index_pattern_prompt.tsx b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_pattern_prompt/empty_index_pattern_prompt.tsx
similarity index 65%
rename from src/plugins/index_pattern_management/public/components/index_pattern_table/empty_index_pattern_prompt/empty_index_pattern_prompt.tsx
rename to src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_pattern_prompt/empty_index_pattern_prompt.tsx
index f36f3a38c73805..054ff9d13b0437 100644
--- a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_index_pattern_prompt/empty_index_pattern_prompt.tsx
+++ b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_pattern_prompt/empty_index_pattern_prompt.tsx
@@ -8,34 +8,26 @@
 
 import './empty_index_pattern_prompt.scss';
 
-import React from 'react';
+import React, { lazy, Suspense } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
 
 import { EuiPageContent, EuiSpacer, EuiText, EuiFlexItem, EuiFlexGroup } from '@elastic/eui';
 import { EuiDescriptionListTitle } from '@elastic/eui';
 import { EuiDescriptionListDescription, EuiDescriptionList } from '@elastic/eui';
-import { EuiLink } from '@elastic/eui';
-import { getListBreadcrumbs } from '../../breadcrumbs';
-import { IndexPatternCreationOption } from '../../types';
-import { CreateButton } from '../../create_button';
-import { Illustration } from './assets/index_pattern_illustration';
-import { ManagementAppMountParams } from '../../../../../management/public';
-
+import { EuiLink, EuiButton, EuiLoadingSpinner } from '@elastic/eui';
 interface Props {
-  canSave: boolean;
-  creationOptions: IndexPatternCreationOption[];
-  docLinksIndexPatternIntro: string;
-  setBreadcrumbs: ManagementAppMountParams['setBreadcrumbs'];
+  goToCreate: () => void;
+  canSaveIndexPattern: boolean;
+  indexPatternsIntroUrl: string;
 }
 
+const Illustration = lazy(() => import('./assets/index_pattern_illustration'));
+
 export const EmptyIndexPatternPrompt = ({
-  canSave,
-  creationOptions,
-  docLinksIndexPatternIntro,
-  setBreadcrumbs,
+  goToCreate,
+  canSaveIndexPattern,
+  indexPatternsIntroUrl,
 }: Props) => {
-  setBreadcrumbs(getListBreadcrumbs());
-
   return (
     <EuiPageContent
       data-test-subj="emptyIndexPatternPrompt"
@@ -47,36 +39,43 @@ export const EmptyIndexPatternPrompt = ({
     >
       <EuiFlexGroup gutterSize="xl" alignItems="center" direction="rowReverse" wrap>
         <EuiFlexItem grow={1} className="inpEmptyIndexPatternPrompt__illustration">
-          <Illustration />
+          <Suspense fallback={<EuiLoadingSpinner size="xl" />}>
+            <Illustration />
+          </Suspense>
         </EuiFlexItem>
         <EuiFlexItem grow={2} className="inpEmptyIndexPatternPrompt__text">
           <EuiText grow={false}>
             <h2>
               <FormattedMessage
-                id="indexPatternManagement.emptyIndexPatternPrompt.youHaveData"
+                id="indexPatternEditor.emptyIndexPatternPrompt.youHaveData"
                 defaultMessage="You have data in Elasticsearch."
               />
               <br />
               <FormattedMessage
-                id="indexPatternManagement.emptyIndexPatternPrompt.nowCreate"
+                id="indexPatternEditor.emptyIndexPatternPrompt.nowCreate"
                 defaultMessage="Now, create an index pattern."
               />
             </h2>
             <p>
               <FormattedMessage
-                id="indexPatternManagement.emptyIndexPatternPrompt.indexPatternExplanation"
-                defaultMessage="Kibana requires an index pattern to identify which indices you want to explore. An
+                id="indexPatternEditor.emptyIndexPatternPrompt.indexPatternExplanation"
+                defaultMessage="Kibana requires an index pattern to identify which data streams, indices, and  aliases you want to explore. An
                 index pattern can point to a specific index, for example, your log data from
                 yesterday, or all indices that contain your log data."
               />
             </p>
-            {canSave && (
-              <CreateButton options={creationOptions}>
+            {canSaveIndexPattern && (
+              <EuiButton
+                onClick={goToCreate}
+                iconType="plusInCircle"
+                fill={true}
+                data-test-subj="createIndexPatternButtonFlyout"
+              >
                 <FormattedMessage
-                  id="indexPatternManagement.indexPatternTable.createBtn"
+                  id="indexPatternEditor.indexPatternTable.createBtn"
                   defaultMessage="Create index pattern"
                 />
-              </CreateButton>
+              </EuiButton>
             )}
           </EuiText>
         </EuiFlexItem>
@@ -85,14 +84,14 @@ export const EmptyIndexPatternPrompt = ({
       <EuiDescriptionList className="inpEmptyIndexPatternPrompt__footer" type="responsiveColumn">
         <EuiDescriptionListTitle className="inpEmptyIndexPatternPrompt__title">
           <FormattedMessage
-            id="indexPatternManagement.emptyIndexPatternPrompt.learnMore"
+            id="indexPatternEditor.emptyIndexPatternPrompt.learnMore"
             defaultMessage="Want to learn more?"
           />
         </EuiDescriptionListTitle>
         <EuiDescriptionListDescription>
-          <EuiLink href={docLinksIndexPatternIntro} target="_blank" external>
+          <EuiLink href={indexPatternsIntroUrl} target="_blank" external>
             <FormattedMessage
-              id="indexPatternManagement.emptyIndexPatternPrompt.documentation"
+              id="indexPatternEditor.emptyIndexPatternPrompt.documentation"
               defaultMessage="Read documentation"
             />
           </EuiLink>
diff --git a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_index_pattern_prompt/index.tsx b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_pattern_prompt/index.tsx
similarity index 100%
rename from src/plugins/index_pattern_management/public/components/index_pattern_table/empty_index_pattern_prompt/index.tsx
rename to src/plugins/index_pattern_editor/public/components/empty_prompts/empty_index_pattern_prompt/index.tsx
diff --git a/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_prompts.tsx b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_prompts.tsx
new file mode 100644
index 00000000000000..3b06fa1cff298e
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/empty_prompts/empty_prompts.tsx
@@ -0,0 +1,92 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React, { useState, useCallback, FC } from 'react';
+
+import { useKibana } from '../../shared_imports';
+
+import { MatchedItem, ResolveIndexResponseItemAlias, IndexPatternEditorContext } from '../../types';
+
+import { getIndices } from '../../lib';
+
+import { EmptyIndexListPrompt } from './empty_index_list_prompt';
+import { EmptyIndexPatternPrompt } from './empty_index_pattern_prompt';
+import { PromptFooter } from './prompt_footer';
+
+const removeAliases = (item: MatchedItem) =>
+  !((item as unknown) as ResolveIndexResponseItemAlias).indices;
+
+interface Props {
+  onCancel: () => void;
+  allSources: MatchedItem[];
+  hasExistingIndexPatterns: boolean;
+  loadSources: () => void;
+}
+
+export const EmptyPrompts: FC<Props> = ({
+  hasExistingIndexPatterns,
+  allSources,
+  onCancel,
+  children,
+  loadSources,
+}) => {
+  const {
+    services: { docLinks, application, http },
+  } = useKibana<IndexPatternEditorContext>();
+
+  const [remoteClustersExist, setRemoteClustersExist] = useState<boolean>(false);
+  const [goToForm, setGoToForm] = useState<boolean>(false);
+
+  const hasDataIndices = allSources.some(({ name }: MatchedItem) => !name.startsWith('.'));
+
+  useCallback(() => {
+    let isMounted = true;
+    if (!hasDataIndices)
+      getIndices(http, () => false, '*:*', false).then((dataSources) => {
+        if (isMounted) {
+          setRemoteClustersExist(!!dataSources.filter(removeAliases).length);
+        }
+      });
+    return () => {
+      isMounted = false;
+    };
+  }, [http, hasDataIndices]);
+
+  if (!hasExistingIndexPatterns && !goToForm) {
+    if (!hasDataIndices && !remoteClustersExist) {
+      // load data
+      return (
+        <>
+          <EmptyIndexListPrompt
+            onRefresh={loadSources}
+            closeFlyout={onCancel}
+            createAnyway={() => setGoToForm(true)}
+            canSaveIndexPattern={application.capabilities.indexPatterns.save as boolean}
+            navigateToApp={application.navigateToApp}
+            addDataUrl={docLinks.links.indexPatterns.introduction}
+          />
+          <PromptFooter onCancel={onCancel} />
+        </>
+      );
+    } else {
+      // first time
+      return (
+        <>
+          <EmptyIndexPatternPrompt
+            goToCreate={() => setGoToForm(true)}
+            indexPatternsIntroUrl={docLinks.links.indexPatterns.introduction}
+            canSaveIndexPattern={application.capabilities.indexPatterns.save as boolean}
+          />
+          <PromptFooter onCancel={onCancel} />
+        </>
+      );
+    }
+  }
+
+  return <>{children}</>;
+};
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/header/index.ts b/src/plugins/index_pattern_editor/public/components/empty_prompts/index.tsx
similarity index 88%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/header/index.ts
rename to src/plugins/index_pattern_editor/public/components/empty_prompts/index.tsx
index 8f737b3a42613b..20bf754e3771ae 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/header/index.ts
+++ b/src/plugins/index_pattern_editor/public/components/empty_prompts/index.tsx
@@ -6,4 +6,4 @@
  * Side Public License, v 1.
  */
 
-export { Header } from './header';
+export { EmptyPrompts } from './empty_prompts';
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/loading_state/index.ts b/src/plugins/index_pattern_editor/public/components/empty_prompts/prompt_footer/index.ts
similarity index 88%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/loading_state/index.ts
rename to src/plugins/index_pattern_editor/public/components/empty_prompts/prompt_footer/index.ts
index 6d39f5bacbcaa1..52b2a82651b284 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/loading_state/index.ts
+++ b/src/plugins/index_pattern_editor/public/components/empty_prompts/prompt_footer/index.ts
@@ -6,4 +6,4 @@
  * Side Public License, v 1.
  */
 
-export { LoadingState } from './loading_state';
+export { PromptFooter } from './prompt_footer';
diff --git a/src/plugins/index_pattern_editor/public/components/empty_prompts/prompt_footer/prompt_footer.tsx b/src/plugins/index_pattern_editor/public/components/empty_prompts/prompt_footer/prompt_footer.tsx
new file mode 100644
index 00000000000000..d1ab3febc5ed3e
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/empty_prompts/prompt_footer/prompt_footer.tsx
@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+
+import { EuiFlyoutFooter, EuiFlexGroup, EuiFlexItem, EuiButtonEmpty } from '@elastic/eui';
+
+const closeButtonLabel = i18n.translate(
+  'indexPatternEditor.editor.emptyPrompt.flyoutCloseButtonLabel',
+  {
+    defaultMessage: 'Close',
+  }
+);
+
+interface PromptFooterProps {
+  onCancel: () => void;
+}
+
+export const PromptFooter = ({ onCancel }: PromptFooterProps) => {
+  return (
+    <EuiFlyoutFooter>
+      <EuiFlexGroup justifyContent="spaceBetween" alignItems="center">
+        <EuiFlexItem grow={false}>
+          <EuiButtonEmpty
+            iconType="cross"
+            flush="left"
+            onClick={onCancel}
+            data-test-subj="closeFlyoutButton"
+          >
+            {closeButtonLabel}
+          </EuiButtonEmpty>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    </EuiFlyoutFooter>
+  );
+};
diff --git a/src/plugins/index_pattern_editor/public/components/flyout_panels/flyout_panel.tsx b/src/plugins/index_pattern_editor/public/components/flyout_panels/flyout_panel.tsx
new file mode 100644
index 00000000000000..8f9193a47327ff
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/flyout_panels/flyout_panel.tsx
@@ -0,0 +1,120 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React, {
+  CSSProperties,
+  useState,
+  useLayoutEffect,
+  useCallback,
+  createContext,
+  useContext,
+} from 'react';
+import classnames from 'classnames';
+import { EuiFlexItem } from '@elastic/eui';
+
+import { useFlyoutPanelsContext } from './flyout_panels';
+
+interface Context {
+  registerFooter: () => void;
+  registerContent: () => void;
+}
+
+const flyoutPanelContext = createContext<Context>({
+  registerFooter: () => {},
+  registerContent: () => {},
+});
+
+export interface Props {
+  /** Width of the panel (in percent %) */
+  width?: number;
+  /** EUI sass background */
+  backgroundColor?: 'euiPageBackground' | 'euiEmptyShade';
+  /** Add a border to the panel */
+  border?: 'left' | 'right';
+}
+
+export const Panel: React.FC<Props & React.HTMLProps<HTMLDivElement>> = ({
+  children,
+  width,
+  className = '',
+  backgroundColor,
+  border,
+  ...rest
+}) => {
+  const [config, setConfig] = useState<{ hasFooter: boolean; hasContent: boolean }>({
+    hasContent: false,
+    hasFooter: false,
+  });
+
+  /* eslint-disable @typescript-eslint/naming-convention */
+  const classes = classnames('fieldEditor__flyoutPanel', className, {
+    'fieldEditor__flyoutPanel--pageBackground': backgroundColor === 'euiPageBackground',
+    'fieldEditor__flyoutPanel--emptyShade': backgroundColor === 'euiEmptyShade',
+    'fieldEditor__flyoutPanel--leftBorder': border === 'left',
+    'fieldEditor__flyoutPanel--rightBorder': border === 'right',
+    'fieldEditor__flyoutPanel--withContent': config.hasContent,
+  });
+  /* eslint-enable @typescript-eslint/naming-convention */
+
+  const { addPanel } = useFlyoutPanelsContext();
+
+  const registerContent = useCallback(() => {
+    setConfig((prev) => {
+      return {
+        ...prev,
+        hasContent: true,
+      };
+    });
+  }, []);
+
+  const registerFooter = useCallback(() => {
+    setConfig((prev) => {
+      if (!prev.hasContent) {
+        throw new Error(
+          'You need to add a <FlyoutPanels.Content /> when you add a <FlyoutPanels.Footer />'
+        );
+      }
+      return {
+        ...prev,
+        hasFooter: true,
+      };
+    });
+  }, []);
+
+  useLayoutEffect(() => {
+    const removePanel = addPanel({ width });
+
+    return removePanel;
+  }, [width, addPanel]);
+
+  const styles: CSSProperties = {};
+
+  if (width) {
+    styles.flexBasis = `${width}%`;
+  }
+
+  return (
+    <EuiFlexItem style={styles}>
+      <flyoutPanelContext.Provider value={{ registerContent, registerFooter }}>
+        <div className={classes} {...rest}>
+          {children}
+        </div>
+      </flyoutPanelContext.Provider>
+    </EuiFlexItem>
+  );
+};
+
+export const useFlyoutPanelContext = (): Context => {
+  const ctx = useContext(flyoutPanelContext);
+
+  if (ctx === undefined) {
+    throw new Error('useFlyoutPanel() must be used within a <flyoutPanelContext.Provider />');
+  }
+
+  return ctx;
+};
diff --git a/src/plugins/index_pattern_editor/public/components/flyout_panels/flyout_panels.scss b/src/plugins/index_pattern_editor/public/components/flyout_panels/flyout_panels.scss
new file mode 100644
index 00000000000000..8ba27700039546
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/flyout_panels/flyout_panels.scss
@@ -0,0 +1,42 @@
+.fieldEditor__flyoutPanels {
+  height: 100%;
+}
+
+.fieldEditor__flyoutPanel {
+  height: 100%;
+  overflow-y: auto;
+  padding: $euiSizeL $euiSizeL 0 $euiSizeL;
+
+  &--pageBackground {
+    background-color: $euiPageBackgroundColor;
+  }
+  &--emptyShade {
+    background-color: $euiColorEmptyShade;
+  }
+  &--leftBorder {
+    border-left: $euiBorderThin;
+  }
+  &--rightBorder {
+    border-right: $euiBorderThin;
+  }
+  &--withContent {
+    padding: 0;
+    overflow-y: hidden;
+    display: flex;
+    flex-direction: column;
+  }
+
+  &__header {
+    padding: 0 !important;
+  }
+
+  &__content {
+    flex: 1;
+    overflow-y: auto;
+    padding: $euiSizeL;
+  }
+
+  &__footer {
+    flex: 0;
+  }
+}
diff --git a/src/plugins/index_pattern_editor/public/components/flyout_panels/flyout_panels.tsx b/src/plugins/index_pattern_editor/public/components/flyout_panels/flyout_panels.tsx
new file mode 100644
index 00000000000000..c878090ec7c1be
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/flyout_panels/flyout_panels.tsx
@@ -0,0 +1,119 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React, {
+  useState,
+  createContext,
+  useContext,
+  useCallback,
+  useMemo,
+  useLayoutEffect,
+} from 'react';
+import { EuiFlexGroup, EuiFlexGroupProps } from '@elastic/eui';
+
+import './flyout_panels.scss';
+
+interface Panel {
+  width?: number;
+}
+
+interface Context {
+  addPanel: (panel: Panel) => () => void;
+}
+
+let idx = 0;
+
+const panelId = () => idx++;
+
+const flyoutPanelsContext = createContext<Context>({
+  addPanel() {
+    return () => {};
+  },
+});
+
+export interface Props {
+  /**
+   * The total max width with all the panels in the DOM
+   * Corresponds to the "maxWidth" prop passed to the EuiFlyout
+   */
+  maxWidth: number;
+  /** The className selector of the flyout */
+  flyoutClassName: string;
+  /** The size between the panels. Corresponds to EuiFlexGroup gutterSize */
+  gutterSize?: EuiFlexGroupProps['gutterSize'];
+}
+
+export const Panels: React.FC<Props> = ({ maxWidth, flyoutClassName, ...props }) => {
+  const flyoutDOMelement = useMemo(() => {
+    const el = document.getElementsByClassName(flyoutClassName);
+
+    if (el.length === 0) {
+      // throw new Error(`Flyout with className "${flyoutClassName}" not found.`);
+      return null;
+    }
+
+    return el.item(0) as HTMLDivElement;
+  }, [flyoutClassName]);
+
+  const [panels, setPanels] = useState<{ [id: number]: Panel }>({});
+
+  const removePanel = useCallback((id: number) => {
+    setPanels((prev) => {
+      const { [id]: panelToRemove, ...rest } = prev;
+      return rest;
+    });
+  }, []);
+
+  const addPanel = useCallback(
+    (panel: Panel) => {
+      const nextId = panelId();
+      setPanels((prev) => {
+        return { ...prev, [nextId]: panel };
+      });
+      return removePanel.bind(null, nextId);
+    },
+    [removePanel]
+  );
+
+  const ctx: Context = useMemo(
+    () => ({
+      addPanel,
+    }),
+    [addPanel]
+  );
+
+  useLayoutEffect(() => {
+    if (!flyoutDOMelement) {
+      return;
+    }
+
+    const totalPercentWidth = Math.min(
+      100,
+      Object.values(panels).reduce((acc, { width = 0 }) => acc + width, 0)
+    );
+    const currentWidth = (maxWidth * totalPercentWidth) / 100;
+
+    flyoutDOMelement.style.maxWidth = `${currentWidth}px`;
+  }, [panels, maxWidth, flyoutClassName, flyoutDOMelement]);
+
+  return (
+    <flyoutPanelsContext.Provider value={ctx}>
+      <EuiFlexGroup className="fieldEditor__flyoutPanels" gutterSize="none" {...props} />
+    </flyoutPanelsContext.Provider>
+  );
+};
+
+export const useFlyoutPanelsContext = (): Context => {
+  const ctx = useContext(flyoutPanelsContext);
+
+  if (ctx === undefined) {
+    throw new Error('<Panel /> must be used within a <Panels /> wrapper');
+  }
+
+  return ctx;
+};
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/header/header.test.tsx b/src/plugins/index_pattern_editor/public/components/flyout_panels/flyout_panels_content.tsx
similarity index 50%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/header/header.test.tsx
rename to src/plugins/index_pattern_editor/public/components/flyout_panels/flyout_panels_content.tsx
index 444e5c49cb497a..a25d4a03a83c8f 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/header/header.test.tsx
+++ b/src/plugins/index_pattern_editor/public/components/flyout_panels/flyout_panels_content.tsx
@@ -5,15 +5,16 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
+import React, { useEffect } from 'react';
 
-import React from 'react';
-import { Header } from '../header';
-import { shallow } from 'enzyme';
+import { useFlyoutPanelContext } from './flyout_panel';
 
-describe('Header', () => {
-  it('should render normally', () => {
-    const component = shallow(<Header indexPattern="ki*" indexPatternName="ki*" />);
+export const PanelContent: React.FC = (props) => {
+  const { registerContent } = useFlyoutPanelContext();
 
-    expect(component).toMatchSnapshot();
-  });
-});
+  useEffect(() => {
+    registerContent();
+  }, [registerContent]);
+
+  return <div className="fieldEditor__flyoutPanel__content" {...props} />;
+};
diff --git a/src/plugins/index_pattern_editor/public/components/flyout_panels/flyout_panels_footer.tsx b/src/plugins/index_pattern_editor/public/components/flyout_panels/flyout_panels_footer.tsx
new file mode 100644
index 00000000000000..8a987420dd84be
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/flyout_panels/flyout_panels_footer.tsx
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import React, { useEffect } from 'react';
+import { EuiFlyoutFooter, EuiFlyoutFooterProps } from '@elastic/eui';
+
+import { useFlyoutPanelContext } from './flyout_panel';
+
+export const PanelFooter: React.FC<
+  { children: React.ReactNode } & Omit<EuiFlyoutFooterProps, 'children'>
+> = (props) => {
+  const { registerFooter } = useFlyoutPanelContext();
+
+  useEffect(() => {
+    registerFooter();
+  }, [registerFooter]);
+
+  return <EuiFlyoutFooter className="fieldEditor__flyoutPanel__footer" {...props} />;
+};
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/loading_state/loading_state.test.tsx b/src/plugins/index_pattern_editor/public/components/flyout_panels/flyout_panels_header.tsx
similarity index 53%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/loading_state/loading_state.test.tsx
rename to src/plugins/index_pattern_editor/public/components/flyout_panels/flyout_panels_header.tsx
index ac10848500f639..00edf1c637fc16 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/loading_state/loading_state.test.tsx
+++ b/src/plugins/index_pattern_editor/public/components/flyout_panels/flyout_panels_header.tsx
@@ -7,13 +7,13 @@
  */
 
 import React from 'react';
-import { LoadingState } from '../loading_state';
-import { shallow } from 'enzyme';
+import { EuiSpacer, EuiFlyoutHeader, EuiFlyoutHeaderProps } from '@elastic/eui';
 
-describe('LoadingState', () => {
-  it('should render normally', () => {
-    const component = shallow(<LoadingState />);
-
-    expect(component).toMatchSnapshot();
-  });
-});
+export const PanelHeader: React.FunctionComponent<
+  { children: React.ReactNode } & Omit<EuiFlyoutHeaderProps, 'children'>
+> = (props) => (
+  <>
+    <EuiFlyoutHeader className="fieldEditor__flyoutPanel__header" {...props} />
+    <EuiSpacer />
+  </>
+);
diff --git a/src/plugins/index_pattern_editor/public/components/flyout_panels/index.ts b/src/plugins/index_pattern_editor/public/components/flyout_panels/index.ts
new file mode 100644
index 00000000000000..9fc9a7a916f564
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/flyout_panels/index.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { PanelFooter } from './flyout_panels_footer';
+import { PanelHeader } from './flyout_panels_header';
+import { PanelContent } from './flyout_panels_content';
+import { Panel } from './flyout_panel';
+import { Panels } from './flyout_panels';
+
+export const FlyoutPanels = {
+  Group: Panels,
+  Item: Panel,
+  Content: PanelContent,
+  Header: PanelHeader,
+  Footer: PanelFooter,
+};
diff --git a/src/plugins/index_pattern_editor/public/components/footer/footer.tsx b/src/plugins/index_pattern_editor/public/components/footer/footer.tsx
new file mode 100644
index 00000000000000..0c80d0e77534c4
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/footer/footer.tsx
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+
+import {
+  EuiFlyoutFooter,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiButtonEmpty,
+  EuiButton,
+} from '@elastic/eui';
+
+interface FooterProps {
+  onCancel: () => void;
+  onSubmit: () => void;
+  submitDisabled: boolean;
+}
+
+const closeButtonLabel = i18n.translate('indexPatternEditor.editor.flyoutCloseButtonLabel', {
+  defaultMessage: 'Close',
+});
+
+const saveButtonLabel = i18n.translate('indexPatternEditor.editor.flyoutSaveButtonLabel', {
+  defaultMessage: 'Create index pattern',
+});
+
+export const Footer = ({ onCancel, onSubmit, submitDisabled }: FooterProps) => {
+  return (
+    <EuiFlyoutFooter className="indexPatternEditor__footer">
+      <EuiFlexGroup justifyContent="spaceBetween" alignItems="center">
+        <EuiFlexItem grow={false}>
+          <EuiButtonEmpty
+            iconType="cross"
+            flush="left"
+            onClick={onCancel}
+            data-test-subj="closeFlyoutButton"
+          >
+            {closeButtonLabel}
+          </EuiButtonEmpty>
+        </EuiFlexItem>
+
+        <EuiFlexItem grow={false}>
+          <EuiButton
+            color="primary"
+            onClick={onSubmit}
+            data-test-subj="saveIndexPatternButton"
+            fill
+            disabled={submitDisabled}
+          >
+            {saveButtonLabel}
+          </EuiButton>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    </EuiFlyoutFooter>
+  );
+};
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/header/index.ts b/src/plugins/index_pattern_editor/public/components/footer/index.ts
similarity index 91%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/header/index.ts
rename to src/plugins/index_pattern_editor/public/components/footer/index.ts
index 8f737b3a42613b..e3103aab170e07 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/header/index.ts
+++ b/src/plugins/index_pattern_editor/public/components/footer/index.ts
@@ -6,4 +6,4 @@
  * Side Public License, v 1.
  */
 
-export { Header } from './header';
+export { Footer } from './footer';
diff --git a/src/plugins/index_pattern_editor/public/components/form_fields/index.ts b/src/plugins/index_pattern_editor/public/components/form_fields/index.ts
new file mode 100644
index 00000000000000..0d2091c065771a
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/form_fields/index.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { TimestampField } from './timestamp_field';
+export { TypeField } from './type_field';
+export { TitleField } from './title_field';
diff --git a/src/plugins/index_pattern_editor/public/components/form_fields/timestamp_field.tsx b/src/plugins/index_pattern_editor/public/components/form_fields/timestamp_field.tsx
new file mode 100644
index 00000000000000..93cb39ea1ba336
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/form_fields/timestamp_field.tsx
@@ -0,0 +1,157 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React, { useMemo } from 'react';
+import { i18n } from '@kbn/i18n';
+
+import { EuiFormRow, EuiComboBox, EuiFormHelpText, EuiComboBoxOptionOption } from '@elastic/eui';
+
+import {
+  UseField,
+  FieldConfig,
+  ValidationConfig,
+  getFieldValidityAndErrorMessage,
+} from '../../shared_imports';
+
+import { TimestampOption } from '../../types';
+import { schema } from '../form_schema';
+
+interface Props {
+  options: TimestampOption[];
+  isLoadingOptions: boolean;
+  isExistingIndexPattern: boolean;
+  isLoadingMatchedIndices: boolean;
+  hasMatchedIndices: boolean;
+}
+
+const requireTimestampOptionValidator = (options: Props['options']): ValidationConfig => ({
+  validator: async ({ value }) => {
+    const isValueRequired = !!options.length;
+    if (isValueRequired && !value) {
+      return {
+        message: i18n.translate(
+          'indexPatternEditor.requireTimestampOption.ValidationErrorMessage',
+          {
+            defaultMessage: 'Select a timestamp field.',
+          }
+        ),
+      };
+    }
+  },
+});
+
+const getTimestampConfig = (
+  options: Props['options']
+): FieldConfig<EuiComboBoxOptionOption<string>> => {
+  const timestampFieldConfig = schema.timestampField;
+
+  const validations = [
+    ...timestampFieldConfig.validations,
+    // note this is responsible for triggering the state update for the selected source list.
+    requireTimestampOptionValidator(options),
+  ];
+
+  return {
+    ...timestampFieldConfig!,
+    validations,
+  };
+};
+
+const noTimestampOptionText = i18n.translate('indexPatternEditor.editor.form.noTimeFieldsLabel', {
+  defaultMessage: 'No matching data stream, index, or alias has a timestamp field.',
+});
+
+const timestampFieldHelp = i18n.translate('indexPatternEditor.editor.form.timeFieldHelp', {
+  defaultMessage: 'Select a timestamp field for use with the global time filter.',
+});
+
+export const TimestampField = ({
+  options = [],
+  isLoadingOptions = false,
+  isExistingIndexPattern,
+  isLoadingMatchedIndices,
+  hasMatchedIndices,
+}: Props) => {
+  const optionsAsComboBoxOptions = options.map(({ display, fieldName }) => ({
+    label: display,
+    value: fieldName,
+  }));
+  const timestampConfig = useMemo(() => getTimestampConfig(options), [options]);
+  const selectTimestampHelp = options.length ? timestampFieldHelp : '';
+
+  const timestampNoFieldsHelp =
+    options.length === 0 &&
+    !isExistingIndexPattern &&
+    !isLoadingMatchedIndices &&
+    !isLoadingOptions &&
+    hasMatchedIndices
+      ? noTimestampOptionText
+      : '';
+
+  return (
+    <UseField<EuiComboBoxOptionOption<string>> config={timestampConfig} path="timestampField">
+      {(field) => {
+        const { label, value, setValue } = field;
+
+        if (value === undefined) {
+          return null;
+        }
+
+        const { isInvalid, errorMessage } = getFieldValidityAndErrorMessage(field);
+        const isDisabled = !optionsAsComboBoxOptions.length;
+
+        return (
+          <>
+            <EuiFormRow
+              label={label}
+              error={isDisabled ? null : errorMessage}
+              isInvalid={!isDisabled && isInvalid}
+              fullWidth
+            >
+              <>
+                <EuiComboBox<string>
+                  placeholder={i18n.translate(
+                    'indexPatternEditor.editor.form.runtimeType.placeholderLabel',
+                    {
+                      defaultMessage: 'Select a timestamp field',
+                    }
+                  )}
+                  singleSelection={{ asPlainText: true }}
+                  options={optionsAsComboBoxOptions}
+                  selectedOptions={value ? [value] : undefined}
+                  onChange={(newValue) => {
+                    if (newValue.length === 0) {
+                      // Don't allow clearing the type. One must always be selected
+                      return;
+                    }
+                    //
+                    setValue(newValue[0]);
+                  }}
+                  isClearable={false}
+                  isDisabled={isDisabled}
+                  data-test-subj="timestampField"
+                  aria-label={i18n.translate(
+                    'indexPatternEditor.editor.form.timestampSelectAriaLabel',
+                    {
+                      defaultMessage: 'Timestamp field',
+                    }
+                  )}
+                  isLoading={isLoadingOptions}
+                  fullWidth
+                />
+                <EuiFormHelpText>
+                  {timestampNoFieldsHelp || selectTimestampHelp || <>&nbsp;</>}
+                </EuiFormHelpText>
+              </>
+            </EuiFormRow>
+          </>
+        );
+      }}
+    </UseField>
+  );
+};
diff --git a/src/plugins/index_pattern_editor/public/components/form_fields/title_field.tsx b/src/plugins/index_pattern_editor/public/components/form_fields/title_field.tsx
new file mode 100644
index 00000000000000..aa16351e0922f2
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/form_fields/title_field.tsx
@@ -0,0 +1,232 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React, { ChangeEvent, useState, useMemo } from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiFormRow, EuiFieldText } from '@elastic/eui';
+import {
+  UseField,
+  getFieldValidityAndErrorMessage,
+  ValidationConfig,
+  FieldConfig,
+} from '../../shared_imports';
+import { canAppendWildcard } from '../../lib';
+import { schema } from '../form_schema';
+import {
+  MatchedItem,
+  RollupIndicesCapsResponse,
+  IndexPatternConfig,
+  MatchedIndicesSet,
+} from '../../types';
+
+interface RefreshMatchedIndicesResult {
+  matchedIndicesResult: MatchedIndicesSet;
+  newRollupIndexName?: string;
+}
+
+interface TitleFieldProps {
+  existingIndexPatterns: string[];
+  isRollup: boolean;
+  matchedIndices: MatchedItem[];
+  rollupIndicesCapabilities: RollupIndicesCapsResponse;
+  refreshMatchedIndices: (title: string) => Promise<RefreshMatchedIndicesResult>;
+}
+
+const rollupIndexPatternNoMatchError = {
+  message: i18n.translate('indexPatternEditor.rollupIndexPattern.createIndex.noMatchError', {
+    defaultMessage: 'Rollup index pattern error: must match one rollup index',
+  }),
+};
+
+const rollupIndexPatternTooManyMatchesError = {
+  message: i18n.translate('indexPatternEditor.rollupIndexPattern.createIndex.tooManyMatchesError', {
+    defaultMessage: 'Rollup index pattern error: can only match one rollup index',
+  }),
+};
+
+const mustMatchError = {
+  message: i18n.translate('indexPatternEditor.createIndex.noMatch', {
+    defaultMessage: 'Name must match one or more data streams, indices, or aliases.',
+  }),
+};
+
+const createTitlesNoDupesValidator = (
+  namesNotAllowed: string[]
+): ValidationConfig<{}, string, string> => ({
+  validator: ({ value }) => {
+    if (namesNotAllowed.includes(value)) {
+      return {
+        message: i18n.translate('indexPatternEditor.indexPatternExists.ValidationErrorMessage', {
+          defaultMessage: 'An index pattern with this title already exists.',
+        }),
+      };
+    }
+  },
+});
+
+interface MatchesValidatorArgs {
+  rollupIndicesCapabilities: Record<string, { error: string }>;
+  refreshMatchedIndices: (title: string) => Promise<RefreshMatchedIndicesResult>;
+  isRollup: boolean;
+}
+
+const createMatchesIndicesValidator = ({
+  rollupIndicesCapabilities,
+  refreshMatchedIndices,
+  isRollup,
+}: MatchesValidatorArgs): ValidationConfig<{}, string, string> => ({
+  validator: async ({ value }) => {
+    const { matchedIndicesResult, newRollupIndexName } = await refreshMatchedIndices(value);
+    const rollupIndices = Object.keys(rollupIndicesCapabilities);
+
+    if (matchedIndicesResult.exactMatchedIndices.length === 0) {
+      return mustMatchError;
+    }
+
+    if (!isRollup || !rollupIndices || !rollupIndices.length) {
+      return;
+    }
+
+    // A rollup index pattern needs to match one and only one rollup index.
+    const rollupIndexMatches = matchedIndicesResult.exactMatchedIndices.filter((matchedIndex) =>
+      rollupIndices.includes(matchedIndex.name)
+    );
+
+    if (!rollupIndexMatches.length) {
+      return rollupIndexPatternNoMatchError;
+    } else if (rollupIndexMatches.length > 1) {
+      return rollupIndexPatternTooManyMatchesError;
+    }
+
+    // Error info is potentially provided via the rollup indices caps request
+    const error = newRollupIndexName && rollupIndicesCapabilities[newRollupIndexName].error;
+
+    if (error) {
+      return {
+        message: i18n.translate('indexPatternEditor.rollup.uncaughtError', {
+          defaultMessage: 'Rollup index pattern error: {error}',
+          values: {
+            error,
+          },
+        }),
+      };
+    }
+  },
+});
+
+interface GetTitleConfigArgs {
+  namesNotAllowed: string[];
+  isRollup: boolean;
+  matchedIndices: MatchedItem[];
+  rollupIndicesCapabilities: RollupIndicesCapsResponse;
+  refreshMatchedIndices: (title: string) => Promise<RefreshMatchedIndicesResult>;
+}
+
+const getTitleConfig = ({
+  namesNotAllowed,
+  isRollup,
+  rollupIndicesCapabilities,
+  refreshMatchedIndices,
+}: GetTitleConfigArgs): FieldConfig<string> => {
+  const titleFieldConfig = schema.title;
+
+  const validations = [
+    ...titleFieldConfig.validations,
+    // note this is responsible for triggering the state update for the selected source list.
+    createMatchesIndicesValidator({
+      rollupIndicesCapabilities,
+      refreshMatchedIndices,
+      isRollup,
+    }),
+    createTitlesNoDupesValidator(namesNotAllowed),
+  ];
+
+  return {
+    ...titleFieldConfig!,
+    validations,
+  };
+};
+
+export const TitleField = ({
+  existingIndexPatterns,
+  isRollup,
+  matchedIndices,
+  rollupIndicesCapabilities,
+  refreshMatchedIndices,
+}: TitleFieldProps) => {
+  const [appendedWildcard, setAppendedWildcard] = useState<boolean>(false);
+
+  const fieldConfig = useMemo(
+    () =>
+      getTitleConfig({
+        namesNotAllowed: existingIndexPatterns,
+        isRollup,
+        matchedIndices,
+        rollupIndicesCapabilities,
+        refreshMatchedIndices,
+      }),
+    [
+      existingIndexPatterns,
+      isRollup,
+      matchedIndices,
+      rollupIndicesCapabilities,
+      refreshMatchedIndices,
+    ]
+  );
+
+  return (
+    <UseField<string, IndexPatternConfig>
+      path="title"
+      config={fieldConfig}
+      componentProps={{
+        euiFieldProps: {
+          'aria-label': i18n.translate('indexPatternEditor.form.titleAriaLabel', {
+            defaultMessage: 'Title field',
+          }),
+        },
+      }}
+    >
+      {(field) => {
+        const { isInvalid, errorMessage } = getFieldValidityAndErrorMessage(field);
+        return (
+          <EuiFormRow
+            label={field.label}
+            labelAppend={field.labelAppend}
+            helpText={typeof field.helpText === 'function' ? field.helpText() : field.helpText}
+            error={errorMessage}
+            isInvalid={isInvalid}
+            fullWidth
+          >
+            <EuiFieldText
+              isInvalid={isInvalid}
+              value={field.value}
+              onChange={(e: ChangeEvent<HTMLInputElement>) => {
+                e.persist();
+                let query = e.target.value;
+                if (query.length === 1 && !appendedWildcard && canAppendWildcard(query)) {
+                  query += '*';
+                  setAppendedWildcard(true);
+                  setTimeout(() => e.target.setSelectionRange(1, 1));
+                } else {
+                  if (['', '*'].includes(query) && appendedWildcard) {
+                    query = '';
+                    setAppendedWildcard(false);
+                  }
+                }
+                field.setValue(query);
+              }}
+              isLoading={field.isValidating}
+              fullWidth
+              data-test-subj="createIndexPatternNameInput"
+            />
+          </EuiFormRow>
+        );
+      }}
+    </UseField>
+  );
+};
diff --git a/src/plugins/index_pattern_editor/public/components/form_fields/type_field.tsx b/src/plugins/index_pattern_editor/public/components/form_fields/type_field.tsx
new file mode 100644
index 00000000000000..606197159e53c9
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/form_fields/type_field.tsx
@@ -0,0 +1,114 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+// @ts-ignore
+import { euiColorAccent } from '@elastic/eui/dist/eui_theme_light.json';
+import { FormattedMessage } from '@kbn/i18n/react';
+
+import {
+  EuiFormRow,
+  EuiSuperSelect,
+  EuiDescriptionList,
+  EuiDescriptionListTitle,
+  EuiDescriptionListDescription,
+  EuiBadge,
+} from '@elastic/eui';
+
+import { UseField } from '../../shared_imports';
+
+import { INDEX_PATTERN_TYPE, IndexPatternConfig } from '../../types';
+
+interface TypeFieldProps {
+  onChange: (type: INDEX_PATTERN_TYPE) => void;
+}
+
+const standardSelectItem = (
+  <EuiDescriptionList style={{ whiteSpace: 'nowrap' }} data-test-subj="standardType">
+    <EuiDescriptionListTitle>
+      <FormattedMessage
+        id="indexPatternEditor.typeSelect.standardTitle"
+        defaultMessage="Standard index pattern"
+      />
+    </EuiDescriptionListTitle>
+    <EuiDescriptionListDescription>
+      <FormattedMessage
+        id="indexPatternEditor.typeSelect.standardDescription"
+        defaultMessage="Perform full aggregations against any data"
+      />
+    </EuiDescriptionListDescription>
+  </EuiDescriptionList>
+);
+
+const rollupSelectItem = (
+  <EuiDescriptionList style={{ whiteSpace: 'nowrap' }} data-test-subj="rollupType">
+    <EuiDescriptionListTitle>
+      <FormattedMessage
+        id="indexPatternEditor.typeSelect.rollupTitle"
+        defaultMessage="Rollup index pattern"
+      />
+      &nbsp;
+      <EuiBadge color={euiColorAccent}>
+        <FormattedMessage id="indexPatternEditor.typeSelect.betaLabel" defaultMessage="Beta" />
+      </EuiBadge>
+    </EuiDescriptionListTitle>
+    <EuiDescriptionListDescription>
+      <FormattedMessage
+        id="indexPatternEditor.typeSelect.rollupDescription"
+        defaultMessage="Perform limited aggregations against summarized data"
+      />
+    </EuiDescriptionListDescription>
+  </EuiDescriptionList>
+);
+
+export const TypeField = ({ onChange }: TypeFieldProps) => {
+  return (
+    <UseField<INDEX_PATTERN_TYPE, IndexPatternConfig> path="type">
+      {({ label, value, setValue }) => {
+        if (value === undefined) {
+          return null;
+        }
+        return (
+          <>
+            <EuiFormRow label={label} fullWidth>
+              <EuiSuperSelect
+                data-test-subj="typeField"
+                options={[
+                  {
+                    value: INDEX_PATTERN_TYPE.DEFAULT,
+                    inputDisplay: i18n.translate('indexPatternEditor.typeSelect.standard', {
+                      defaultMessage: 'Standard',
+                    }),
+                    dropdownDisplay: standardSelectItem,
+                  },
+                  {
+                    value: INDEX_PATTERN_TYPE.ROLLUP,
+                    inputDisplay: i18n.translate('indexPatternEditor.typeSelect.rollup', {
+                      defaultMessage: 'Rollup',
+                    }),
+                    dropdownDisplay: rollupSelectItem,
+                  },
+                ]}
+                valueOfSelected={value}
+                onChange={(newValue) => {
+                  setValue(newValue);
+                  onChange(newValue);
+                }}
+                aria-label={i18n.translate('indexPatternEditor.editor.form.typeSelectAriaLabel', {
+                  defaultMessage: 'Type field',
+                })}
+                fullWidth
+              />
+            </EuiFormRow>
+          </>
+        );
+      }}
+    </UseField>
+  );
+};
diff --git a/src/plugins/index_pattern_editor/public/components/form_schema.ts b/src/plugins/index_pattern_editor/public/components/form_schema.ts
new file mode 100644
index 00000000000000..4e852285031caa
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/form_schema.ts
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { fieldValidators } from '../shared_imports';
+import { INDEX_PATTERN_TYPE } from '../types';
+
+export const schema = {
+  title: {
+    label: i18n.translate('indexPatternEditor.editor.form.titleLabel', {
+      defaultMessage: 'Name',
+    }),
+    defaultValue: '',
+    helpText: i18n.translate('indexPatternEditor.validations.titleHelpText', {
+      defaultMessage:
+        'Use an asterisk (*) to match multiple indices. Spaces and the characters , /, ?, ", <, >, | are not allowed.',
+    }),
+    validations: [
+      {
+        validator: fieldValidators.emptyField(
+          i18n.translate('indexPatternEditor.validations.titleIsRequiredErrorMessage', {
+            defaultMessage: 'A name is required.',
+          })
+        ),
+      },
+    ],
+  },
+  timestampField: {
+    label: i18n.translate('indexPatternEditor.editor.form.timeFieldLabel', {
+      defaultMessage: 'Timestamp field',
+    }),
+    helpText: i18n.translate('indexPatternEditor.editor.form.timestampFieldHelp', {
+      defaultMessage: 'Select a timestamp field for use with the global time filter.',
+    }),
+    validations: [],
+  },
+  allowHidden: {
+    label: i18n.translate('indexPatternEditor.editor.form.allowHiddenLabel', {
+      defaultMessage: 'Allow hidden and system indices',
+    }),
+    defaultValue: false,
+  },
+  id: {
+    label: i18n.translate('indexPatternEditor.editor.form.customIdLabel', {
+      defaultMessage: 'Custom index pattern ID',
+    }),
+    helpText: i18n.translate('indexPatternEditor.editor.form.customIdHelp', {
+      defaultMessage:
+        'Kibana provides a unique identifier for each index pattern, or you can create your own.',
+    }),
+  },
+  type: {
+    label: i18n.translate('indexPatternEditor.editor.form.TypeLabel', {
+      defaultMessage: 'Index pattern type',
+    }),
+    defaultValue: INDEX_PATTERN_TYPE.DEFAULT,
+  },
+};
diff --git a/src/plugins/index_pattern_editor/public/components/i18n_texts.ts b/src/plugins/index_pattern_editor/public/components/i18n_texts.ts
new file mode 100644
index 00000000000000..5745714ae7bd80
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/i18n_texts.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const geti18nTexts = () => {
+  return {
+    noTimestampOptionText: i18n.translate(
+      'indexPatternEditor.createIndexPattern.stepTime.noTimeFieldsLabel',
+      {
+        defaultMessage: 'No matching data stream, index, or alias has a timestamp field.',
+      }
+    ),
+    timestampFieldHelp: i18n.translate('indexPatternEditor.editor.form.timeFieldHelp', {
+      defaultMessage: 'Select a timestamp field for use with the global time filter.',
+    }),
+    rollupLabel: i18n.translate('indexPatternEditor.rollupIndexPattern.createIndex.indexLabel', {
+      defaultMessage: 'Rollup',
+    }),
+  };
+};
diff --git a/src/plugins/index_pattern_editor/public/components/index.ts b/src/plugins/index_pattern_editor/public/components/index.ts
new file mode 100644
index 00000000000000..82da708ac859d5
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/index.ts
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export {
+  IndexPatternEditorFlyoutContent,
+  Props as IndexPatternEditorFlyoutContentProps,
+} from './index_pattern_editor_flyout_content';
+
+export { IndexPatternEditor } from './index_pattern_editor';
+
+export { schema } from './form_schema';
+export { TimestampField, TypeField, TitleField } from './form_fields';
+export { EmptyPrompts } from './empty_prompts';
+export { PreviewPanel } from './preview_panel';
+export { LoadingIndices } from './loading_indices';
+export { geti18nTexts } from './i18n_texts';
+export { Footer } from './footer';
+export { AdvancedParamsContent } from './advanced_params_content';
+export { RollupBetaWarning } from './rollup_beta_warning';
diff --git a/src/plugins/index_pattern_editor/public/components/index_pattern_editor.scss b/src/plugins/index_pattern_editor/public/components/index_pattern_editor.scss
new file mode 100644
index 00000000000000..5b3a30effc767c
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/index_pattern_editor.scss
@@ -0,0 +1,13 @@
+.indexPatternEditor__form {
+  flex-grow: 1;
+}
+
+.fieldEditor__mainFlyoutPanel {
+  display: flex;
+  flex-direction: column;
+}
+
+.indexPatternEditor__footer {
+  margin-left: -$euiSizeL;
+  margin-right: -$euiSizeL;
+}
diff --git a/src/plugins/index_pattern_editor/public/components/index_pattern_editor.tsx b/src/plugins/index_pattern_editor/public/components/index_pattern_editor.tsx
new file mode 100644
index 00000000000000..bc0b6156a78441
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/index_pattern_editor.tsx
@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { EuiFlyout } from '@elastic/eui';
+import { IndexPatternEditorLazy } from './index_pattern_editor_lazy';
+import { IndexPatternEditorContext, IndexPatternEditorProps } from '../types';
+import { createKibanaReactContext } from '../shared_imports';
+import './index_pattern_editor.scss';
+
+export interface IndexPatternEditorPropsWithServices extends IndexPatternEditorProps {
+  services: IndexPatternEditorContext;
+}
+
+export const IndexPatternEditor = ({
+  onSave,
+  onCancel = () => {},
+  services,
+  defaultTypeIsRollup = false,
+  requireTimestampField = false,
+}: IndexPatternEditorPropsWithServices) => {
+  const {
+    Provider: KibanaReactContextProvider,
+  } = createKibanaReactContext<IndexPatternEditorContext>(services);
+
+  return (
+    <KibanaReactContextProvider>
+      <EuiFlyout onClose={() => {}} hideCloseButton={true} size="l">
+        <IndexPatternEditorLazy
+          onSave={onSave}
+          onCancel={onCancel}
+          defaultTypeIsRollup={defaultTypeIsRollup}
+          requireTimestampField={requireTimestampField}
+        />
+      </EuiFlyout>
+    </KibanaReactContextProvider>
+  );
+};
diff --git a/src/plugins/index_pattern_editor/public/components/index_pattern_editor_flyout_content.tsx b/src/plugins/index_pattern_editor/public/components/index_pattern_editor_flyout_content.tsx
new file mode 100644
index 00000000000000..cabff9bfb009b7
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/index_pattern_editor_flyout_content.tsx
@@ -0,0 +1,379 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React, { useState, useEffect, useCallback, useRef } from 'react';
+import { EuiTitle, EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiLoadingSpinner } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+import {
+  IndexPatternSpec,
+  Form,
+  useForm,
+  useFormData,
+  useKibana,
+  GetFieldsOptions,
+} from '../shared_imports';
+
+import { ensureMinimumTime, getIndices, extractTimeFields, getMatchedIndices } from '../lib';
+import { FlyoutPanels } from './flyout_panels';
+
+import {
+  MatchedItem,
+  IndexPatternEditorContext,
+  RollupIndicesCapsResponse,
+  INDEX_PATTERN_TYPE,
+  IndexPatternConfig,
+  MatchedIndicesSet,
+  FormInternal,
+  TimestampOption,
+} from '../types';
+
+import {
+  TimestampField,
+  TypeField,
+  TitleField,
+  schema,
+  Footer,
+  AdvancedParamsContent,
+  EmptyPrompts,
+  PreviewPanel,
+  RollupBetaWarning,
+} from '.';
+
+export interface Props {
+  /**
+   * Handler for the "save" footer button
+   */
+  onSave: (indexPatternSpec: IndexPatternSpec) => void;
+  /**
+   * Handler for the "cancel" footer button
+   */
+  onCancel: () => void;
+  defaultTypeIsRollup?: boolean;
+  requireTimestampField?: boolean;
+}
+
+const editorTitle = i18n.translate('indexPatternEditor.title', {
+  defaultMessage: 'Create index pattern',
+});
+
+const IndexPatternEditorFlyoutContentComponent = ({
+  onSave,
+  onCancel,
+  defaultTypeIsRollup,
+  requireTimestampField = false,
+}: Props) => {
+  const isMounted = useRef<boolean>(false);
+  const {
+    services: { http, indexPatternService, uiSettings },
+  } = useKibana<IndexPatternEditorContext>();
+
+  const { form } = useForm<IndexPatternConfig, FormInternal>({
+    defaultValue: {
+      type: defaultTypeIsRollup ? INDEX_PATTERN_TYPE.ROLLUP : INDEX_PATTERN_TYPE.DEFAULT,
+    },
+    schema,
+    onSubmit: async (formData, isValid) => {
+      if (!isValid) {
+        return;
+      }
+
+      const indexPatternStub: IndexPatternSpec = {
+        title: formData.title,
+        timeFieldName: formData.timestampField?.value,
+        id: formData.id,
+      };
+
+      if (type === INDEX_PATTERN_TYPE.ROLLUP && rollupIndex) {
+        indexPatternStub.type = INDEX_PATTERN_TYPE.ROLLUP;
+        indexPatternStub.typeMeta = {
+          params: {
+            rollup_index: rollupIndex,
+          },
+          aggs: rollupIndicesCapabilities[rollupIndex].aggs,
+        };
+      }
+
+      await onSave(indexPatternStub);
+    },
+  });
+
+  const { getFields } = form;
+
+  const [{ title, allowHidden, type }] = useFormData<FormInternal>({ form });
+  const [isLoadingSources, setIsLoadingSources] = useState<boolean>(true);
+
+  const [timestampFieldOptions, setTimestampFieldOptions] = useState<TimestampOption[]>([]);
+  const [isLoadingTimestampFields, setIsLoadingTimestampFields] = useState<boolean>(false);
+  const [isLoadingMatchedIndices, setIsLoadingMatchedIndices] = useState<boolean>(false);
+  const [allSources, setAllSources] = useState<MatchedItem[]>([]);
+  const [isLoadingIndexPatterns, setIsLoadingIndexPatterns] = useState<boolean>(true);
+  const [existingIndexPatterns, setExistingIndexPatterns] = useState<string[]>([]);
+  const [rollupIndex, setRollupIndex] = useState<string | undefined>();
+  const [
+    rollupIndicesCapabilities,
+    setRollupIndicesCapabilities,
+  ] = useState<RollupIndicesCapsResponse>({});
+  const [matchedIndices, setMatchedIndices] = useState<MatchedIndicesSet>({
+    allIndices: [],
+    exactMatchedIndices: [],
+    partialMatchedIndices: [],
+    visibleIndices: [],
+  });
+
+  // load all data sources and set initial matchedIndices
+  const loadSources = useCallback(() => {
+    getIndices(http, () => false, '*', allowHidden).then((dataSources) => {
+      setAllSources(dataSources);
+      const matchedSet = getMatchedIndices(dataSources, [], [], allowHidden);
+      setMatchedIndices(matchedSet);
+      setIsLoadingSources(false);
+    });
+  }, [http, allowHidden]);
+
+  // loading list of index patterns
+  useEffect(() => {
+    isMounted.current = true;
+    loadSources();
+    const getTitles = async () => {
+      const indexPatternTitles = await indexPatternService.getTitles();
+      if (isMounted.current) {
+        setExistingIndexPatterns(indexPatternTitles);
+        setIsLoadingIndexPatterns(false);
+      }
+    };
+    getTitles();
+    return () => {
+      isMounted.current = false;
+    };
+  }, [http, indexPatternService, loadSources]);
+
+  // loading rollup info
+  useEffect(() => {
+    const getRollups = async () => {
+      try {
+        const response = await http.get('/api/rollup/indices');
+        if (isMounted.current) {
+          setRollupIndicesCapabilities(response || {});
+        }
+      } catch (e) {
+        // Silently swallow failure responses such as expired trials
+      }
+    };
+
+    getRollups();
+  }, [http, type]);
+
+  const getRollupIndices = (rollupCaps: RollupIndicesCapsResponse) => Object.keys(rollupCaps);
+
+  const loadTimestampFieldOptions = useCallback(
+    async (query: string) => {
+      let timestampOptions: TimestampOption[] = [];
+      const isValidResult =
+        !existingIndexPatterns.includes(query) && matchedIndices.exactMatchedIndices.length > 0;
+      if (isValidResult) {
+        setIsLoadingTimestampFields(true);
+        const getFieldsOptions: GetFieldsOptions = {
+          pattern: query,
+        };
+        if (type === INDEX_PATTERN_TYPE.ROLLUP) {
+          getFieldsOptions.type = INDEX_PATTERN_TYPE.ROLLUP;
+          getFieldsOptions.rollupIndex = rollupIndex;
+        }
+
+        const fields = await ensureMinimumTime(
+          indexPatternService.getFieldsForWildcard(getFieldsOptions)
+        );
+        timestampOptions = extractTimeFields(fields, requireTimestampField);
+      }
+      if (isMounted.current) {
+        setIsLoadingTimestampFields(false);
+        setTimestampFieldOptions(timestampOptions);
+      }
+      return timestampOptions;
+    },
+    [
+      existingIndexPatterns,
+      indexPatternService,
+      requireTimestampField,
+      rollupIndex,
+      type,
+      matchedIndices.exactMatchedIndices,
+    ]
+  );
+
+  useEffect(() => {
+    loadTimestampFieldOptions(title);
+    getFields().timestampField?.setValue('');
+  }, [matchedIndices, loadTimestampFieldOptions, title, getFields]);
+
+  const reloadMatchedIndices = useCallback(
+    async (newTitle: string) => {
+      const isRollupIndex = (indexName: string) =>
+        getRollupIndices(rollupIndicesCapabilities).includes(indexName);
+      let newRollupIndexName: string | undefined;
+
+      const fetchIndices = async (query: string = '') => {
+        setIsLoadingMatchedIndices(true);
+        const indexRequests = [];
+
+        if (query?.endsWith('*')) {
+          const exactMatchedQuery = getIndices(http, isRollupIndex, query, allowHidden);
+          indexRequests.push(exactMatchedQuery);
+          // provide default value when not making a request for the partialMatchQuery
+          indexRequests.push(Promise.resolve([]));
+        } else {
+          const exactMatchQuery = getIndices(http, isRollupIndex, query, allowHidden);
+          const partialMatchQuery = getIndices(http, isRollupIndex, `${query}*`, allowHidden);
+
+          indexRequests.push(exactMatchQuery);
+          indexRequests.push(partialMatchQuery);
+        }
+
+        const [exactMatched, partialMatched] = (await ensureMinimumTime(
+          indexRequests
+        )) as MatchedItem[][];
+
+        const matchedIndicesResult = getMatchedIndices(
+          allSources,
+          partialMatched,
+          exactMatched,
+          allowHidden
+        );
+
+        if (isMounted.current) {
+          if (type === INDEX_PATTERN_TYPE.ROLLUP) {
+            const rollupIndices = exactMatched.filter((index) => isRollupIndex(index.name));
+            newRollupIndexName = rollupIndices.length === 1 ? rollupIndices[0].name : undefined;
+            setRollupIndex(newRollupIndexName);
+          } else {
+            setRollupIndex(undefined);
+          }
+
+          setMatchedIndices(matchedIndicesResult);
+          setIsLoadingMatchedIndices(false);
+        }
+
+        return { matchedIndicesResult, newRollupIndexName };
+      };
+
+      return fetchIndices(newTitle);
+    },
+    [http, allowHidden, allSources, type, rollupIndicesCapabilities]
+  );
+
+  useEffect(() => {
+    reloadMatchedIndices(title);
+  }, [allowHidden, reloadMatchedIndices, title]);
+
+  const onTypeChange = useCallback(
+    (newType) => {
+      form.setFieldValue('title', '');
+      form.setFieldValue('timestampField', '');
+      if (newType === INDEX_PATTERN_TYPE.ROLLUP) {
+        form.setFieldValue('allowHidden', false);
+      }
+    },
+    [form]
+  );
+
+  if (isLoadingSources || isLoadingIndexPatterns) {
+    return <EuiLoadingSpinner size="xl" />;
+  }
+
+  const showIndexPatternTypeSelect = () =>
+    uiSettings.isDeclared('rollups:enableIndexPatterns') &&
+    uiSettings.get('rollups:enableIndexPatterns') &&
+    getRollupIndices(rollupIndicesCapabilities).length;
+
+  const indexPatternTypeSelect = showIndexPatternTypeSelect() ? (
+    <>
+      <EuiSpacer size="m" />
+      <EuiFlexGroup>
+        <EuiFlexItem>
+          <TypeField onChange={onTypeChange} />
+        </EuiFlexItem>
+      </EuiFlexGroup>
+      {type === INDEX_PATTERN_TYPE.ROLLUP ? (
+        <EuiFlexGroup>
+          <EuiFlexItem>
+            <RollupBetaWarning />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      ) : (
+        <></>
+      )}
+    </>
+  ) : (
+    <></>
+  );
+
+  return (
+    <EmptyPrompts
+      onCancel={onCancel}
+      allSources={allSources}
+      hasExistingIndexPatterns={!!existingIndexPatterns.length}
+      loadSources={loadSources}
+    >
+      <FlyoutPanels.Group flyoutClassName={'indexPatternEditorFlyout'} maxWidth={1180}>
+        <FlyoutPanels.Item className="fieldEditor__mainFlyoutPanel" border="right">
+          <EuiTitle data-test-subj="flyoutTitle">
+            <h2>{editorTitle}</h2>
+          </EuiTitle>
+          <Form form={form} className="indexPatternEditor__form">
+            {indexPatternTypeSelect}
+            <EuiSpacer size="m" />
+            <EuiFlexGroup>
+              <EuiFlexItem>
+                <TitleField
+                  isRollup={form.getFields().type?.value === INDEX_PATTERN_TYPE.ROLLUP}
+                  existingIndexPatterns={existingIndexPatterns}
+                  refreshMatchedIndices={reloadMatchedIndices}
+                  matchedIndices={matchedIndices.exactMatchedIndices}
+                  rollupIndicesCapabilities={rollupIndicesCapabilities}
+                />
+              </EuiFlexItem>
+            </EuiFlexGroup>
+            <EuiSpacer size="m" />
+            <EuiFlexGroup>
+              <EuiFlexItem>
+                <TimestampField
+                  options={timestampFieldOptions}
+                  isLoadingOptions={isLoadingTimestampFields}
+                  isExistingIndexPattern={existingIndexPatterns.includes(title)}
+                  isLoadingMatchedIndices={isLoadingMatchedIndices}
+                  hasMatchedIndices={!!matchedIndices.exactMatchedIndices.length}
+                />
+              </EuiFlexItem>
+            </EuiFlexGroup>
+            <AdvancedParamsContent disableAllowHidden={type === INDEX_PATTERN_TYPE.ROLLUP} />
+          </Form>
+          <Footer
+            onCancel={onCancel}
+            onSubmit={() => form.submit()}
+            submitDisabled={form.isSubmitted && !form.isValid}
+          />
+        </FlyoutPanels.Item>
+        <FlyoutPanels.Item>
+          {isLoadingSources ? (
+            <></>
+          ) : (
+            <PreviewPanel
+              type={type}
+              allowHidden={allowHidden}
+              title={title}
+              matched={matchedIndices}
+            />
+          )}
+        </FlyoutPanels.Item>
+      </FlyoutPanels.Group>
+    </EmptyPrompts>
+  );
+};
+
+export const IndexPatternEditorFlyoutContent = React.memo(IndexPatternEditorFlyoutContentComponent);
diff --git a/src/plugins/index_pattern_editor/public/components/index_pattern_editor_lazy.tsx b/src/plugins/index_pattern_editor/public/components/index_pattern_editor_lazy.tsx
new file mode 100644
index 00000000000000..4241f042af0d54
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/index_pattern_editor_lazy.tsx
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React, { lazy, Suspense } from 'react';
+import { EuiLoadingSpinner } from '@elastic/eui';
+
+import { IndexPatternEditorProps } from '../types';
+
+const IndexPatternFlyoutContentContainer = lazy(
+  () => import('./index_pattern_flyout_content_container')
+);
+
+export const IndexPatternEditorLazy = (props: IndexPatternEditorProps) => (
+  <Suspense fallback={<EuiLoadingSpinner size="xl" />}>
+    <IndexPatternFlyoutContentContainer {...props} />
+  </Suspense>
+);
diff --git a/src/plugins/index_pattern_editor/public/components/index_pattern_flyout_content_container.tsx b/src/plugins/index_pattern_editor/public/components/index_pattern_flyout_content_container.tsx
new file mode 100644
index 00000000000000..2f60d856772074
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/index_pattern_flyout_content_container.tsx
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+
+import { IndexPatternSpec, useKibana } from '../shared_imports';
+import { IndexPatternEditorFlyoutContent } from './index_pattern_editor_flyout_content';
+import { IndexPatternEditorContext, IndexPatternEditorProps } from '../types';
+
+const IndexPatternFlyoutContentContainer = ({
+  onSave,
+  onCancel = () => {},
+  defaultTypeIsRollup,
+  requireTimestampField = false,
+}: IndexPatternEditorProps) => {
+  const {
+    services: { indexPatternService, notifications },
+  } = useKibana<IndexPatternEditorContext>();
+
+  const onSaveClick = async (indexPatternSpec: IndexPatternSpec) => {
+    try {
+      const indexPattern = await indexPatternService.createAndSave(indexPatternSpec);
+
+      const message = i18n.translate('indexPatternEditor.saved', {
+        defaultMessage: "Saved '{indexPatternTitle}'",
+        values: { indexPatternTitle: indexPattern.title },
+      });
+      notifications.toasts.addSuccess(message);
+      await onSave(indexPattern);
+    } catch (e) {
+      const title = i18n.translate('indexPatternEditor.indexPatterns.unableSaveLabel', {
+        defaultMessage: 'Failed to save index pattern.',
+      });
+
+      notifications.toasts.addDanger({ title });
+    }
+  };
+
+  return (
+    <IndexPatternEditorFlyoutContent
+      onSave={onSaveClick}
+      onCancel={onCancel}
+      defaultTypeIsRollup={defaultTypeIsRollup}
+      requireTimestampField={requireTimestampField}
+    />
+  );
+};
+
+/* eslint-disable import/no-default-export */
+export default IndexPatternFlyoutContentContainer;
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/loading_indices/__snapshots__/loading_indices.test.tsx.snap b/src/plugins/index_pattern_editor/public/components/loading_indices/__snapshots__/loading_indices.test.tsx.snap
similarity index 88%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/loading_indices/__snapshots__/loading_indices.test.tsx.snap
rename to src/plugins/index_pattern_editor/public/components/loading_indices/__snapshots__/loading_indices.test.tsx.snap
index a5517f6d4b6167..8c62657c7859ef 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/loading_indices/__snapshots__/loading_indices.test.tsx.snap
+++ b/src/plugins/index_pattern_editor/public/components/loading_indices/__snapshots__/loading_indices.test.tsx.snap
@@ -18,7 +18,7 @@ exports[`LoadingIndices should render normally 1`] = `
       >
         <FormattedMessage
           defaultMessage="Looking for matching indices…"
-          id="indexPatternManagement.createIndexPattern.step.loadingHeader"
+          id="indexPatternEditor.loadingHeader"
           values={Object {}}
         />
       </h3>
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/loading_indices/index.ts b/src/plugins/index_pattern_editor/public/components/loading_indices/index.ts
similarity index 100%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/loading_indices/index.ts
rename to src/plugins/index_pattern_editor/public/components/loading_indices/index.ts
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/loading_indices/loading_indices.test.tsx b/src/plugins/index_pattern_editor/public/components/loading_indices/loading_indices.test.tsx
similarity index 100%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/loading_indices/loading_indices.test.tsx
rename to src/plugins/index_pattern_editor/public/components/loading_indices/loading_indices.test.tsx
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/loading_indices/loading_indices.tsx b/src/plugins/index_pattern_editor/public/components/loading_indices/loading_indices.tsx
similarity index 93%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/loading_indices/loading_indices.tsx
rename to src/plugins/index_pattern_editor/public/components/loading_indices/loading_indices.tsx
index eb17027c63a3d1..14ae51567938d5 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/loading_indices/loading_indices.tsx
+++ b/src/plugins/index_pattern_editor/public/components/loading_indices/loading_indices.tsx
@@ -24,7 +24,7 @@ export const LoadingIndices = ({ ...rest }) => (
       <EuiTitle size="s">
         <h3 className="eui-textCenter">
           <FormattedMessage
-            id="indexPatternManagement.createIndexPattern.step.loadingHeader"
+            id="indexPatternEditor.loadingHeader"
             defaultMessage="Looking for matching indices…"
           />
         </h3>
diff --git a/src/plugins/index_pattern_management/public/components/create_button/index.ts b/src/plugins/index_pattern_editor/public/components/preview_panel/index.ts
similarity index 88%
rename from src/plugins/index_pattern_management/public/components/create_button/index.ts
rename to src/plugins/index_pattern_editor/public/components/preview_panel/index.ts
index 497096d2fb7bcb..c677d9878f1832 100644
--- a/src/plugins/index_pattern_management/public/components/create_button/index.ts
+++ b/src/plugins/index_pattern_editor/public/components/preview_panel/index.ts
@@ -6,4 +6,4 @@
  * Side Public License, v 1.
  */
 
-export { CreateButton } from './create_button';
+export { PreviewPanel } from './preview_panel';
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/indices_list/__snapshots__/indices_list.test.tsx.snap b/src/plugins/index_pattern_editor/public/components/preview_panel/indices_list/__snapshots__/indices_list.test.tsx.snap
similarity index 97%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/indices_list/__snapshots__/indices_list.test.tsx.snap
rename to src/plugins/index_pattern_editor/public/components/preview_panel/indices_list/__snapshots__/indices_list.test.tsx.snap
index ca41dddf6197ec..74d803a6ff1768 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/indices_list/__snapshots__/indices_list.test.tsx.snap
+++ b/src/plugins/index_pattern_editor/public/components/preview_panel/indices_list/__snapshots__/indices_list.test.tsx.snap
@@ -47,7 +47,7 @@ exports[`IndicesList should change pages 1`] = `
           >
             <FormattedMessage
               defaultMessage="Rows per page: {perPage}"
-              id="indexPatternManagement.createIndexPattern.step.pagingLabel"
+              id="indexPatternEditor.pagingLabel"
               values={
                 Object {
                   "perPage": 1,
@@ -140,7 +140,7 @@ exports[`IndicesList should change per page 1`] = `
           >
             <FormattedMessage
               defaultMessage="Rows per page: {perPage}"
-              id="indexPatternManagement.createIndexPattern.step.pagingLabel"
+              id="indexPatternEditor.pagingLabel"
               values={
                 Object {
                   "perPage": 1,
@@ -255,7 +255,7 @@ exports[`IndicesList should highlight the query in the matches 1`] = `
           >
             <FormattedMessage
               defaultMessage="Rows per page: {perPage}"
-              id="indexPatternManagement.createIndexPattern.step.pagingLabel"
+              id="indexPatternEditor.pagingLabel"
               values={
                 Object {
                   "perPage": 10,
@@ -356,7 +356,7 @@ exports[`IndicesList should render normally 1`] = `
           >
             <FormattedMessage
               defaultMessage="Rows per page: {perPage}"
-              id="indexPatternManagement.createIndexPattern.step.pagingLabel"
+              id="indexPatternEditor.pagingLabel"
               values={
                 Object {
                   "perPage": 10,
@@ -521,7 +521,7 @@ exports[`IndicesList updating props should render all new indices 1`] = `
           >
             <FormattedMessage
               defaultMessage="Rows per page: {perPage}"
-              id="indexPatternManagement.createIndexPattern.step.pagingLabel"
+              id="indexPatternEditor.pagingLabel"
               values={
                 Object {
                   "perPage": 10,
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/indices_list/index.ts b/src/plugins/index_pattern_editor/public/components/preview_panel/indices_list/index.ts
similarity index 100%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/indices_list/index.ts
rename to src/plugins/index_pattern_editor/public/components/preview_panel/indices_list/index.ts
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/indices_list/indices_list.test.tsx b/src/plugins/index_pattern_editor/public/components/preview_panel/indices_list/indices_list.test.tsx
similarity index 97%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/indices_list/indices_list.test.tsx
rename to src/plugins/index_pattern_editor/public/components/preview_panel/indices_list/indices_list.test.tsx
index e9ff29ad73f29c..6d40861cb4e0ff 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/indices_list/indices_list.test.tsx
+++ b/src/plugins/index_pattern_editor/public/components/preview_panel/indices_list/indices_list.test.tsx
@@ -9,7 +9,7 @@
 import React from 'react';
 import { IndicesList } from '../indices_list';
 import { shallow } from 'enzyme';
-import { MatchedItem } from '../../../../types';
+import { MatchedItem } from '../../../types';
 
 const indices = ([
   { name: 'kibana', tags: [] },
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/indices_list/indices_list.tsx b/src/plugins/index_pattern_editor/public/components/preview_panel/indices_list/indices_list.tsx
similarity index 96%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/indices_list/indices_list.tsx
rename to src/plugins/index_pattern_editor/public/components/preview_panel/indices_list/indices_list.tsx
index 16c9f7b7e11b1c..dc0d8dc9842165 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/indices_list/indices_list.tsx
+++ b/src/plugins/index_pattern_editor/public/components/preview_panel/indices_list/indices_list.tsx
@@ -27,8 +27,7 @@ import {
 import { Pager } from '@elastic/eui';
 
 import { FormattedMessage } from '@kbn/i18n/react';
-import { PER_PAGE_INCREMENTS } from '../../../../constants';
-import { MatchedItem, Tag } from '../../../../types';
+import { MatchedItem, Tag } from '../../../types';
 
 interface IndicesListProps {
   indices: MatchedItem[];
@@ -41,6 +40,8 @@ interface IndicesListState {
   isPerPageControlOpen: boolean;
 }
 
+const PER_PAGE_INCREMENTS = [5, 10, 20, 50];
+
 export class IndicesList extends React.Component<IndicesListProps, IndicesListState> {
   pager: Pager;
   constructor(props: IndicesListProps) {
@@ -96,7 +97,7 @@ export class IndicesList extends React.Component<IndicesListProps, IndicesListSt
         onClick={this.openPerPageControl}
       >
         <FormattedMessage
-          id="indexPatternManagement.createIndexPattern.step.pagingLabel"
+          id="indexPatternEditor.pagingLabel"
           defaultMessage="Rows per page: {perPage}"
           values={{ perPage }}
         />
diff --git a/src/plugins/index_pattern_editor/public/components/preview_panel/preview_panel.tsx b/src/plugins/index_pattern_editor/public/components/preview_panel/preview_panel.tsx
new file mode 100644
index 00000000000000..28413debdb2a94
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/preview_panel/preview_panel.tsx
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { EuiSpacer } from '@elastic/eui';
+import { StatusMessage } from './status_message';
+import { IndicesList } from './indices_list';
+
+import { INDEX_PATTERN_TYPE, MatchedIndicesSet } from '../../types';
+
+interface Props {
+  type: INDEX_PATTERN_TYPE;
+  allowHidden: boolean;
+  title: string;
+  matched: MatchedIndicesSet;
+}
+
+export const PreviewPanel = ({ type, allowHidden, title = '', matched }: Props) => {
+  const indicesListContent =
+    matched.visibleIndices.length || matched.allIndices.length ? (
+      <>
+        <EuiSpacer />
+        <IndicesList
+          data-test-subj="createIndexPatternStep1IndicesList"
+          query={title}
+          indices={title.length ? matched.visibleIndices : matched.allIndices}
+        />
+      </>
+    ) : (
+      <></>
+    );
+
+  return (
+    <>
+      <StatusMessage
+        matchedIndices={matched}
+        showSystemIndices={type === INDEX_PATTERN_TYPE.ROLLUP ? false : true}
+        isIncludingSystemIndices={allowHidden}
+        query={title}
+      />
+      {indicesListContent}
+    </>
+  );
+};
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/status_message/__snapshots__/status_message.test.tsx.snap b/src/plugins/index_pattern_editor/public/components/preview_panel/status_message/__snapshots__/status_message.test.tsx.snap
similarity index 66%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/status_message/__snapshots__/status_message.test.tsx.snap
rename to src/plugins/index_pattern_editor/public/components/preview_panel/status_message/__snapshots__/status_message.test.tsx.snap
index 44b753c4738038..8b492be417bff0 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/status_message/__snapshots__/status_message.test.tsx.snap
+++ b/src/plugins/index_pattern_editor/public/components/preview_panel/status_message/__snapshots__/status_message.test.tsx.snap
@@ -11,7 +11,7 @@ exports[`StatusMessage should render with exact matches 1`] = `
        
       <FormattedMessage
         defaultMessage="Your index pattern matches {sourceCount} {sourceCount, plural, one {source} other {sources} }."
-        id="indexPatternManagement.createIndexPattern.step.status.successLabel.successDetail"
+        id="indexPatternEditor.status.successLabel.successDetail"
         values={
           Object {
             "sourceCount": 1,
@@ -31,15 +31,14 @@ exports[`StatusMessage should render with no partial matches 1`] = `
   title={
     <span>
       <FormattedMessage
-        defaultMessage="The index pattern you've entered doesn't match any indices. You can match {indicesLength, plural, one {your} other {any of your} } {strongIndices}, below."
-        id="indexPatternManagement.createIndexPattern.step.status.notMatchLabel.notMatchDetail"
+        defaultMessage="The index pattern you've entered doesn't match any indices, data streams, or index aliases. You can match {strongIndices}, below."
+        id="indexPatternEditor.status.notMatchLabel.notMatchDetail"
         values={
           Object {
-            "indicesLength": 2,
             "strongIndices": <strong>
               <FormattedMessage
-                defaultMessage="{indicesLength, plural, one {# index} other {# indices} }"
-                id="indexPatternManagement.createIndexPattern.step.status.notMatchLabel.allIndicesLabel"
+                defaultMessage="{indicesLength, plural, one {# source} other {# sources} }"
+                id="indexPatternEditor.status.notMatchLabel.allIndicesLabel"
                 values={
                   Object {
                     "indicesLength": 2,
@@ -63,15 +62,15 @@ exports[`StatusMessage should render with partial matches 1`] = `
   title={
     <span>
       <FormattedMessage
-        defaultMessage="Your index pattern doesn't match any indices, but you have {strongIndices} which {matchedIndicesLength, plural, one {looks} other {look} } similar."
-        id="indexPatternManagement.createIndexPattern.step.status.partialMatchLabel.partialMatchDetail"
+        defaultMessage="Your index pattern doesn't match any sources, but you have {strongIndices} which {matchedIndicesLength, plural, one {is} other {are} } similar."
+        id="indexPatternEditor.status.partialMatchLabel.partialMatchDetail"
         values={
           Object {
             "matchedIndicesLength": 1,
             "strongIndices": <strong>
               <FormattedMessage
-                defaultMessage="{matchedIndicesLength, plural, one {index} other {# indices} }"
-                id="indexPatternManagement.createIndexPattern.step.status.partialMatchLabel.strongIndicesLabel"
+                defaultMessage="{matchedIndicesLength, plural, one {source} other {# sources} }"
+                id="indexPatternEditor.status.partialMatchLabel.strongIndicesLabel"
                 values={
                   Object {
                     "matchedIndicesLength": 1,
@@ -95,8 +94,8 @@ exports[`StatusMessage should render without a query 1`] = `
   title={
     <span>
       <FormattedMessage
-        defaultMessage="Your index pattern can match {sourceCount, plural, one {your # source} other {any of your # sources} }."
-        id="indexPatternManagement.createIndexPattern.step.status.matchAnyLabel.matchAnyDetail"
+        defaultMessage="Your index pattern has {sourceCount, plural, one {# match} other {# matches} }."
+        id="indexPatternEditor.status.matchAnyLabel.matchAnyDetail"
         values={
           Object {
             "sourceCount": 2,
@@ -117,7 +116,7 @@ exports[`StatusMessage should show that no indices exist 1`] = `
     <span>
       <FormattedMessage
         defaultMessage="No Elasticsearch indices match your pattern."
-        id="indexPatternManagement.createIndexPattern.step.status.noSystemIndicesLabel"
+        id="indexPatternEditor.status.noSystemIndicesLabel"
         values={Object {}}
       />
     </span>
@@ -134,7 +133,7 @@ exports[`StatusMessage should show that system indices exist 1`] = `
     <span>
       <FormattedMessage
         defaultMessage="No Elasticsearch indices match your pattern."
-        id="indexPatternManagement.createIndexPattern.step.status.noSystemIndicesLabel"
+        id="indexPatternEditor.status.noSystemIndicesLabel"
         values={Object {}}
       />
     </span>
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/status_message/index.ts b/src/plugins/index_pattern_editor/public/components/preview_panel/status_message/index.ts
similarity index 100%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/status_message/index.ts
rename to src/plugins/index_pattern_editor/public/components/preview_panel/status_message/index.ts
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/status_message/status_message.test.tsx b/src/plugins/index_pattern_editor/public/components/preview_panel/status_message/status_message.test.tsx
similarity index 96%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/status_message/status_message.test.tsx
rename to src/plugins/index_pattern_editor/public/components/preview_panel/status_message/status_message.test.tsx
index 6201440d5e7ffd..1bae9bdf3c666b 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/status_message/status_message.test.tsx
+++ b/src/plugins/index_pattern_editor/public/components/preview_panel/status_message/status_message.test.tsx
@@ -9,7 +9,7 @@
 import React from 'react';
 import { StatusMessage } from '../status_message';
 import { shallow } from 'enzyme';
-import { MatchedItem } from '../../../../types';
+import { MatchedItem } from '../../../types';
 
 const tagsPartial = {
   tags: [],
@@ -22,6 +22,7 @@ const matchedIndices = {
   ] as unknown) as MatchedItem[],
   exactMatchedIndices: [] as MatchedItem[],
   partialMatchedIndices: ([{ name: 'kibana', ...tagsPartial }] as unknown) as MatchedItem[],
+  visibleIndices: [],
 };
 
 describe('StatusMessage', () => {
@@ -94,6 +95,7 @@ describe('StatusMessage', () => {
           allIndices: [],
           exactMatchedIndices: [],
           partialMatchedIndices: [],
+          visibleIndices: [],
         }}
         isIncludingSystemIndices={false}
         query={''}
@@ -111,6 +113,7 @@ describe('StatusMessage', () => {
           allIndices: [],
           exactMatchedIndices: [],
           partialMatchedIndices: [],
+          visibleIndices: [],
         }}
         isIncludingSystemIndices={true}
         query={''}
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/status_message/status_message.tsx b/src/plugins/index_pattern_editor/public/components/preview_panel/status_message/status_message.tsx
similarity index 58%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/status_message/status_message.tsx
rename to src/plugins/index_pattern_editor/public/components/preview_panel/status_message/status_message.tsx
index 0ab41ed1a5be4f..871ed79c27de52 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/status_message/status_message.tsx
+++ b/src/plugins/index_pattern_editor/public/components/preview_panel/status_message/status_message.tsx
@@ -12,19 +12,48 @@ import { EuiCallOut } from '@elastic/eui';
 import { EuiIconType } from '@elastic/eui/src/components/icon/icon';
 
 import { FormattedMessage } from '@kbn/i18n/react';
-import { MatchedItem } from '../../../../types';
+import { MatchedIndicesSet } from '../../../types';
 
 interface StatusMessageProps {
-  matchedIndices: {
-    allIndices: MatchedItem[];
-    exactMatchedIndices: MatchedItem[];
-    partialMatchedIndices: MatchedItem[];
-  };
+  matchedIndices: MatchedIndicesSet;
   isIncludingSystemIndices: boolean;
   query: string;
   showSystemIndices: boolean;
 }
 
+const NoMatchStatusMessage = (allIndicesLength: number) => (
+  <span>
+    <FormattedMessage
+      id="indexPatternEditor.status.notMatchLabel.notMatchDetail"
+      defaultMessage="The index pattern you've entered doesn't match any indices, data streams, or index aliases.
+  You can match {strongIndices}, below."
+      values={{
+        strongIndices: (
+          <strong>
+            <FormattedMessage
+              id="indexPatternEditor.status.notMatchLabel.allIndicesLabel"
+              defaultMessage="{indicesLength, plural,
+            one {# source}
+            other {# sources}
+          }"
+              values={{ indicesLength: allIndicesLength }}
+            />
+          </strong>
+        ),
+      }}
+    />
+  </span>
+);
+
+const NoMatchNoIndicesStatusMessage = () => (
+  <span>
+    <FormattedMessage
+      id="indexPatternEditor.status.notMatchLabel.notMatchNoIndicesDetail"
+      defaultMessage="The index pattern you've entered doesn't match any indices."
+    />
+  </span>
+);
+
 export const StatusMessage: React.FC<StatusMessageProps> = ({
   matchedIndices: { allIndices = [], exactMatchedIndices = [], partialMatchedIndices = [] },
   isIncludingSystemIndices,
@@ -45,10 +74,10 @@ export const StatusMessage: React.FC<StatusMessageProps> = ({
       statusMessage = (
         <span>
           <FormattedMessage
-            id="indexPatternManagement.createIndexPattern.step.status.matchAnyLabel.matchAnyDetail"
-            defaultMessage="Your index pattern can match {sourceCount, plural,
-              one {your # source}
-              other {any of your # sources}
+            id="indexPatternEditor.status.matchAnyLabel.matchAnyDetail"
+            defaultMessage="Your index pattern has {sourceCount, plural,
+              one {# match}
+              other {# matches}
             }."
             values={{ sourceCount: allIndicesLength }}
           />
@@ -58,8 +87,8 @@ export const StatusMessage: React.FC<StatusMessageProps> = ({
       statusMessage = (
         <span>
           <FormattedMessage
-            id="indexPatternManagement.createIndexPattern.step.status.noSystemIndicesWithPromptLabel"
-            defaultMessage="No Elasticsearch indices match your pattern. To view the matching system indices, toggle the switch above."
+            id="indexPatternEditor.status.noSystemIndicesWithPromptLabel"
+            defaultMessage="No Elasticsearch indices match your pattern."
           />
         </span>
       );
@@ -67,7 +96,7 @@ export const StatusMessage: React.FC<StatusMessageProps> = ({
       statusMessage = (
         <span>
           <FormattedMessage
-            id="indexPatternManagement.createIndexPattern.step.status.noSystemIndicesLabel"
+            id="indexPatternEditor.status.noSystemIndicesLabel"
             defaultMessage="No Elasticsearch indices match your pattern."
           />
         </span>
@@ -80,7 +109,7 @@ export const StatusMessage: React.FC<StatusMessageProps> = ({
       <span>
         &nbsp;
         <FormattedMessage
-          id="indexPatternManagement.createIndexPattern.step.status.successLabel.successDetail"
+          id="indexPatternEditor.status.successLabel.successDetail"
           defaultMessage="Your index pattern matches {sourceCount} {sourceCount, plural,
             one {source}
             other {sources}
@@ -97,21 +126,21 @@ export const StatusMessage: React.FC<StatusMessageProps> = ({
     statusMessage = (
       <span>
         <FormattedMessage
-          id="indexPatternManagement.createIndexPattern.step.status.partialMatchLabel.partialMatchDetail"
-          defaultMessage="Your index pattern doesn't match any indices, but you have {strongIndices} which
+          id="indexPatternEditor.status.partialMatchLabel.partialMatchDetail"
+          defaultMessage="Your index pattern doesn't match any sources, but you have {strongIndices} which
           {matchedIndicesLength, plural,
-            one {looks}
-            other {look}
+            one {is}
+            other {are}
           } similar."
           values={{
             matchedIndicesLength: partialMatchedIndices.length,
             strongIndices: (
               <strong>
                 <FormattedMessage
-                  id="indexPatternManagement.createIndexPattern.step.status.partialMatchLabel.strongIndicesLabel"
+                  id="indexPatternEditor.status.partialMatchLabel.strongIndicesLabel"
                   defaultMessage="{matchedIndicesLength, plural,
-                    one {index}
-                    other {# indices}
+                    one {source}
+                    other {# sources}
                   }"
                   values={{ matchedIndicesLength: partialMatchedIndices.length }}
                 />
@@ -124,33 +153,9 @@ export const StatusMessage: React.FC<StatusMessageProps> = ({
   } else {
     statusIcon = undefined;
     statusColor = 'warning';
-    statusMessage = (
-      <span>
-        <FormattedMessage
-          id="indexPatternManagement.createIndexPattern.step.status.notMatchLabel.notMatchDetail"
-          defaultMessage="The index pattern you've entered doesn't match any indices.
-          You can match {indicesLength, plural,
-            one {your}
-            other {any of your}
-          } {strongIndices}, below."
-          values={{
-            strongIndices: (
-              <strong>
-                <FormattedMessage
-                  id="indexPatternManagement.createIndexPattern.step.status.notMatchLabel.allIndicesLabel"
-                  defaultMessage="{indicesLength, plural,
-                    one {# index}
-                    other {# indices}
-                  }"
-                  values={{ indicesLength: allIndicesLength }}
-                />
-              </strong>
-            ),
-            indicesLength: allIndicesLength,
-          }}
-        />
-      </span>
-    );
+    statusMessage = allIndicesLength
+      ? NoMatchStatusMessage(allIndicesLength)
+      : NoMatchNoIndicesStatusMessage();
   }
 
   return (
diff --git a/src/plugins/index_pattern_editor/public/components/rollup_beta_warning/index.ts b/src/plugins/index_pattern_editor/public/components/rollup_beta_warning/index.ts
new file mode 100644
index 00000000000000..4c72c12312855c
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/rollup_beta_warning/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { RollupBetaWarning } from './rollup_beta_warning';
diff --git a/src/plugins/index_pattern_editor/public/components/rollup_beta_warning/rollup_beta_warning.tsx b/src/plugins/index_pattern_editor/public/components/rollup_beta_warning/rollup_beta_warning.tsx
new file mode 100644
index 00000000000000..fcd61bab07d4c5
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/components/rollup_beta_warning/rollup_beta_warning.tsx
@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+
+import { EuiCallOut } from '@elastic/eui';
+
+const rollupBetaWarningTitle = i18n.translate(
+  'indexPatternEditor.rollupIndexPattern.warning.title',
+  {
+    defaultMessage: 'Beta feature',
+  }
+);
+
+export const RollupBetaWarning = () => (
+  <EuiCallOut title={rollupBetaWarningTitle} color="warning" iconType="help">
+    <p>
+      <FormattedMessage
+        id="indexPatternEditor.rollupIndexPattern.warning.textParagraphOne"
+        defaultMessage="Kibana's support for rollup index patterns is in beta. You might encounter
+issues using these patterns in saved searches, visualizations, and dashboards. They
+are not supported in some advanced features, such as Timelion, and Machine Learning."
+      />
+    </p>
+    <p>
+      <FormattedMessage
+        id="indexPatternEditor.rollupIndexPattern.warning.textParagraphTwo"
+        defaultMessage="You can match a rollup index pattern against one rollup index and zero or more
+regular indices. A rollup index pattern has limited metrics, fields, intervals, and
+aggregations. A rollup index is limited to indices that have one job configuration,
+or multiple jobs with compatible configurations."
+      />
+    </p>
+  </EuiCallOut>
+);
diff --git a/src/plugins/index_pattern_editor/public/constants.ts b/src/plugins/index_pattern_editor/public/constants.ts
new file mode 100644
index 00000000000000..ff74e0827fa501
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/constants.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export const pluginName = 'index_pattern_editor';
+export const MAX_NUMBER_OF_MATCHING_INDICES = 100;
+export const CONFIG_ROLLUPS = 'rollups:enableIndexPatterns';
diff --git a/src/plugins/index_pattern_editor/public/index.ts b/src/plugins/index_pattern_editor/public/index.ts
new file mode 100644
index 00000000000000..76c184f9399f12
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/index.ts
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+/**
+ * Management Plugin - public
+ *
+ * This is the entry point for the entire client-side public contract of the plugin.
+ * If something is not explicitly exported here, you can safely assume it is private
+ * to the plugin and not considered stable.
+ *
+ * All stateful contracts will be injected by the platform at runtime, and are defined
+ * in the setup/start interfaces in `plugin.ts`. The remaining items exported here are
+ * either types, or static code.
+ */
+
+import { IndexPatternEditorPlugin } from './plugin';
+
+export type { PluginStart as IndexPatternEditorStart, IndexPatternEditorProps } from './types';
+
+export function plugin() {
+  return new IndexPatternEditorPlugin();
+}
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/__snapshots__/get_indices.test.ts.snap b/src/plugins/index_pattern_editor/public/lib/__snapshots__/get_indices.test.ts.snap
similarity index 100%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/__snapshots__/get_indices.test.ts.snap
rename to src/plugins/index_pattern_editor/public/lib/__snapshots__/get_indices.test.ts.snap
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/can_append_wildcard.test.ts b/src/plugins/index_pattern_editor/public/lib/can_append_wildcard.test.ts
similarity index 100%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/can_append_wildcard.test.ts
rename to src/plugins/index_pattern_editor/public/lib/can_append_wildcard.test.ts
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/can_append_wildcard.ts b/src/plugins/index_pattern_editor/public/lib/can_append_wildcard.ts
similarity index 100%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/can_append_wildcard.ts
rename to src/plugins/index_pattern_editor/public/lib/can_append_wildcard.ts
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/contains_illegal_characters.ts b/src/plugins/index_pattern_editor/public/lib/contains_illegal_characters.ts
similarity index 100%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/contains_illegal_characters.ts
rename to src/plugins/index_pattern_editor/public/lib/contains_illegal_characters.ts
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/contains_invalid_characters.test.ts b/src/plugins/index_pattern_editor/public/lib/contains_invalid_characters.test.ts
similarity index 100%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/contains_invalid_characters.test.ts
rename to src/plugins/index_pattern_editor/public/lib/contains_invalid_characters.test.ts
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/ensure_minimum_time.test.ts b/src/plugins/index_pattern_editor/public/lib/ensure_minimum_time.test.ts
similarity index 79%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/ensure_minimum_time.test.ts
rename to src/plugins/index_pattern_editor/public/lib/ensure_minimum_time.test.ts
index 1bda1b9b5394c5..6fb80df3f89327 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/ensure_minimum_time.test.ts
+++ b/src/plugins/index_pattern_editor/public/lib/ensure_minimum_time.test.ts
@@ -9,28 +9,25 @@
 import { ensureMinimumTime } from './ensure_minimum_time';
 
 describe('ensureMinimumTime', () => {
-  it('resolves single promise', async (done) => {
+  it('resolves single promise', async () => {
     const promiseA = new Promise((resolve) => resolve('a'));
     const a = await ensureMinimumTime(promiseA, 0);
     expect(a).toBe('a');
-    done();
   });
 
-  it('resolves multiple promises', async (done) => {
-    const promiseA = new Promise((resolve) => resolve('a'));
-    const promiseB = new Promise((resolve) => resolve('b'));
+  it('resolves multiple promises', async () => {
+    const promiseA = new Promise<string>((resolve) => resolve('a'));
+    const promiseB = new Promise<string>((resolve) => resolve('b'));
     const [a, b] = await ensureMinimumTime([promiseA, promiseB], 0);
     expect(a).toBe('a');
     expect(b).toBe('b');
-    done();
   });
 
-  it('resolves in the amount of time provided, at minimum', async (done) => {
+  it('resolves in the amount of time provided, at minimum', async () => {
     const startTime = new Date().getTime();
     const promise = new Promise<void>((resolve) => resolve());
     await ensureMinimumTime(promise, 100);
     const endTime = new Date().getTime();
     expect(endTime - startTime).toBeGreaterThanOrEqual(100);
-    done();
   });
 });
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/ensure_minimum_time.ts b/src/plugins/index_pattern_editor/public/lib/ensure_minimum_time.ts
similarity index 95%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/ensure_minimum_time.ts
rename to src/plugins/index_pattern_editor/public/lib/ensure_minimum_time.ts
index cab11ff3b5a379..5c52446efbe344 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/ensure_minimum_time.ts
+++ b/src/plugins/index_pattern_editor/public/lib/ensure_minimum_time.ts
@@ -15,8 +15,8 @@
 
 export const DEFAULT_MINIMUM_TIME_MS = 300;
 
-export async function ensureMinimumTime(
-  promiseOrPromises: Promise<any> | Array<Promise<any>>,
+export async function ensureMinimumTime<T>(
+  promiseOrPromises: Promise<T> | Array<Promise<T>>,
   minimumTimeMs = DEFAULT_MINIMUM_TIME_MS
 ) {
   let returnValue;
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/extract_time_fields.test.ts b/src/plugins/index_pattern_editor/public/lib/extract_time_fields.test.ts
similarity index 76%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/extract_time_fields.test.ts
rename to src/plugins/index_pattern_editor/public/lib/extract_time_fields.test.ts
index 071c21d229524a..bc3e4209f5db7b 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/extract_time_fields.test.ts
+++ b/src/plugins/index_pattern_editor/public/lib/extract_time_fields.test.ts
@@ -16,18 +16,16 @@ describe('extractTimeFields', () => {
       { type: 'text', name: 'name' },
     ] as IndexPatternField[];
 
-    expect(extractTimeFields(fields)).toEqual([
-      { display: `The indices which match this index pattern don't contain any time fields.` },
-    ]);
+    expect(extractTimeFields(fields)).toEqual([]);
   });
 
   it('should add extra options', () => {
     const fields = [{ type: 'date', name: '@timestamp' }] as IndexPatternField[];
 
+    // const extractedFields = extractTimeFields(fields);
     expect(extractTimeFields(fields)).toEqual([
       { display: '@timestamp', fieldName: '@timestamp' },
-      { isDisabled: true, display: '───', fieldName: '' },
-      { display: `I don't want to use the time filter`, fieldName: undefined },
+      { display: `--- I don't want to use the time filter ---`, fieldName: '' },
     ]);
   });
 });
diff --git a/src/plugins/index_pattern_editor/public/lib/extract_time_fields.ts b/src/plugins/index_pattern_editor/public/lib/extract_time_fields.ts
new file mode 100644
index 00000000000000..82b94b5c6744a6
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/lib/extract_time_fields.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { IndexPatternField } from '../../../../plugins/data/public';
+import { TimestampOption } from '../types';
+
+export function extractTimeFields(
+  fields: IndexPatternField[],
+  requireTimestampField: boolean = false
+): TimestampOption[] {
+  const dateFields = fields.filter((field) => field.type === 'date');
+
+  if (dateFields.length === 0) {
+    return [];
+  }
+
+  const noTimeFieldLabel = i18n.translate(
+    'indexPatternEditor.createIndexPattern.stepTime.noTimeFieldOptionLabel',
+    {
+      defaultMessage: "--- I don't want to use the time filter ---",
+    }
+  );
+  const noTimeFieldOption = {
+    display: noTimeFieldLabel,
+    fieldName: '',
+  };
+
+  const timeFields = dateFields.map((field) => ({
+    display: field.name,
+    fieldName: field.name,
+  }));
+
+  if (!requireTimestampField) {
+    timeFields.push(noTimeFieldOption);
+  }
+
+  return timeFields;
+}
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/get_indices.test.ts b/src/plugins/index_pattern_editor/public/lib/get_indices.test.ts
similarity index 79%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/get_indices.test.ts
rename to src/plugins/index_pattern_editor/public/lib/get_indices.test.ts
index 29330cefc4806d..fc96482f0379fc 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/get_indices.test.ts
+++ b/src/plugins/index_pattern_editor/public/lib/get_indices.test.ts
@@ -7,7 +7,7 @@
  */
 
 import { getIndices, responseToItemArray } from './get_indices';
-import { httpServiceMock } from '../../../../../../core/public/mocks';
+import { httpServiceMock } from '../../../../core/public/mocks';
 import { ResolveIndexResponseItemIndexAttrs } from '../types';
 
 export const successfulResponse = {
@@ -33,26 +33,27 @@ export const successfulResponse = {
 };
 
 const mockGetTags = () => [];
+const mockIsRollupIndex = () => false;
 
 const http = httpServiceMock.createStartContract();
 http.get.mockResolvedValue(successfulResponse);
 
 describe('getIndices', () => {
   it('should work in a basic case', async () => {
-    const result = await getIndices(http, mockGetTags, 'kibana', false);
+    const result = await getIndices(http, mockIsRollupIndex, 'kibana', false);
     expect(result.length).toBe(3);
     expect(result[0].name).toBe('f-alias');
     expect(result[1].name).toBe('foo');
   });
 
   it('should ignore ccs query-all', async () => {
-    expect((await getIndices(http, mockGetTags, '*:', false)).length).toBe(0);
+    expect((await getIndices(http, mockIsRollupIndex, '*:', false)).length).toBe(0);
   });
 
   it('should ignore a single comma', async () => {
-    expect((await getIndices(http, mockGetTags, ',', false)).length).toBe(0);
-    expect((await getIndices(http, mockGetTags, ',*', false)).length).toBe(0);
-    expect((await getIndices(http, mockGetTags, ',foobar', false)).length).toBe(0);
+    expect((await getIndices(http, mockIsRollupIndex, ',', false)).length).toBe(0);
+    expect((await getIndices(http, mockIsRollupIndex, ',*', false)).length).toBe(0);
+    expect((await getIndices(http, mockIsRollupIndex, ',foobar', false)).length).toBe(0);
   });
 
   it('response object to item array', () => {
@@ -89,7 +90,7 @@ describe('getIndices', () => {
       http.get.mockImplementationOnce(() => {
         throw new Error('Test error');
       });
-      const result = await getIndices(http, mockGetTags, 'kibana', false);
+      const result = await getIndices(http, mockIsRollupIndex, 'kibana', false);
       expect(result.length).toBe(0);
     });
   });
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/get_indices.ts b/src/plugins/index_pattern_editor/public/lib/get_indices.ts
similarity index 73%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/get_indices.ts
rename to src/plugins/index_pattern_editor/public/lib/get_indices.ts
index e7edd177c2bda1..625e99ecbcdc55 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/get_indices.ts
+++ b/src/plugins/index_pattern_editor/public/lib/get_indices.ts
@@ -9,25 +9,41 @@
 import { sortBy } from 'lodash';
 import { HttpStart } from 'kibana/public';
 import { i18n } from '@kbn/i18n';
-import { IndexPatternCreationConfig } from '../../../../../index_pattern_management/public';
+import { Tag, INDEX_PATTERN_TYPE } from '../types';
+// todo move into this plugin, consider removing all ipm references
 import { MatchedItem, ResolveIndexResponse, ResolveIndexResponseItemIndexAttrs } from '../types';
 
-const aliasLabel = i18n.translate('indexPatternManagement.aliasLabel', { defaultMessage: 'Alias' });
-const dataStreamLabel = i18n.translate('indexPatternManagement.dataStreamLabel', {
+const aliasLabel = i18n.translate('indexPatternEditor.aliasLabel', { defaultMessage: 'Alias' });
+const dataStreamLabel = i18n.translate('indexPatternEditor.dataStreamLabel', {
   defaultMessage: 'Data stream',
 });
 
-const indexLabel = i18n.translate('indexPatternManagement.indexLabel', {
+const indexLabel = i18n.translate('indexPatternEditor.indexLabel', {
   defaultMessage: 'Index',
 });
 
-const frozenLabel = i18n.translate('indexPatternManagement.frozenLabel', {
+const frozenLabel = i18n.translate('indexPatternEditor.frozenLabel', {
   defaultMessage: 'Frozen',
 });
 
+const rollupLabel = i18n.translate('indexPatternEditor.rollupLabel', {
+  defaultMessage: 'Rollup',
+});
+
+const getIndexTags = (isRollupIndex: (indexName: string) => boolean) => (indexName: string) =>
+  isRollupIndex(indexName)
+    ? [
+        {
+          key: INDEX_PATTERN_TYPE.ROLLUP,
+          name: rollupLabel,
+          color: 'primary',
+        },
+      ]
+    : [];
+
 export async function getIndices(
   http: HttpStart,
-  getIndexTags: IndexPatternCreationConfig['getIndexTags'],
+  isRollupIndex: (indexName: string) => boolean,
   rawPattern: string,
   showAllIndices: boolean
 ): Promise<MatchedItem[]> {
@@ -62,7 +78,7 @@ export async function getIndices(
       return [];
     }
 
-    return responseToItemArray(response, getIndexTags);
+    return responseToItemArray(response, getIndexTags(isRollupIndex));
   } catch {
     return [];
   }
@@ -70,7 +86,7 @@ export async function getIndices(
 
 export const responseToItemArray = (
   response: ResolveIndexResponse,
-  getIndexTags: IndexPatternCreationConfig['getIndexTags']
+  getTags: (indexName: string) => Tag[]
 ): MatchedItem[] => {
   const source: MatchedItem[] = [];
 
@@ -78,7 +94,7 @@ export const responseToItemArray = (
     const tags: MatchedItem['tags'] = [{ key: 'index', name: indexLabel, color: 'default' }];
     const isFrozen = (index.attributes || []).includes(ResolveIndexResponseItemIndexAttrs.FROZEN);
 
-    tags.push(...getIndexTags(index.name));
+    tags.push(...getTags(index.name));
     if (isFrozen) {
       tags.push({ name: frozenLabel, key: 'frozen', color: 'danger' });
     }
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/get_matched_indices.test.ts b/src/plugins/index_pattern_editor/public/lib/get_matched_indices.test.ts
similarity index 100%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/get_matched_indices.test.ts
rename to src/plugins/index_pattern_editor/public/lib/get_matched_indices.test.ts
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/get_matched_indices.ts b/src/plugins/index_pattern_editor/public/lib/get_matched_indices.ts
similarity index 97%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/get_matched_indices.ts
rename to src/plugins/index_pattern_editor/public/lib/get_matched_indices.ts
index e9b365474425b7..0b659aa5fbc76a 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/get_matched_indices.ts
+++ b/src/plugins/index_pattern_editor/public/lib/get_matched_indices.ts
@@ -23,10 +23,6 @@ function isSystemIndex(index: string): boolean {
 }
 
 function filterSystemIndices(indices: MatchedItem[], isIncludingSystemIndices: boolean) {
-  if (!indices) {
-    return indices;
-  }
-
   const acceptableIndices = isIncludingSystemIndices
     ? indices
     : // All system indices begin with a period.
@@ -54,14 +50,14 @@ function filterSystemIndices(indices: MatchedItem[], isIncludingSystemIndices: b
     We call this `exact` matches because ES is telling us exactly what it matches
  */
 
-import { MatchedItem } from '../types';
+import { MatchedItem, MatchedIndicesSet } from '../types';
 
 export function getMatchedIndices(
   unfilteredAllIndices: MatchedItem[],
   unfilteredPartialMatchedIndices: MatchedItem[],
   unfilteredExactMatchedIndices: MatchedItem[],
   isIncludingSystemIndices: boolean = false
-) {
+): MatchedIndicesSet {
   const allIndices = filterSystemIndices(unfilteredAllIndices, isIncludingSystemIndices);
   const partialMatchedIndices = filterSystemIndices(
     unfilteredPartialMatchedIndices,
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/index.ts b/src/plugins/index_pattern_editor/public/lib/index.ts
similarity index 100%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/index.ts
rename to src/plugins/index_pattern_editor/public/lib/index.ts
diff --git a/src/plugins/index_pattern_editor/public/mocks.ts b/src/plugins/index_pattern_editor/public/mocks.ts
new file mode 100644
index 00000000000000..c7ac1d61e3c10c
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/mocks.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { IndexPatternEditorPlugin } from './plugin';
+
+export type Start = jest.Mocked<ReturnType<IndexPatternEditorPlugin['start']>>;
+
+export type Setup = jest.Mocked<ReturnType<IndexPatternEditorPlugin['setup']>>;
+
+const createSetupContract = (): Setup => {
+  return {};
+};
+
+const createStartContract = (): Start => {
+  return {
+    openEditor: jest.fn(),
+    IndexPatternEditorComponent: jest.fn(),
+    userPermissions: {
+      editIndexPattern: jest.fn(),
+    },
+  };
+};
+
+export const indexPatternEditorPluginMock = {
+  createSetupContract,
+  createStartContract,
+};
diff --git a/src/plugins/index_pattern_editor/public/open_editor.tsx b/src/plugins/index_pattern_editor/public/open_editor.tsx
new file mode 100644
index 00000000000000..ec62a1d6ec7c6d
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/open_editor.tsx
@@ -0,0 +1,92 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { CoreStart, OverlayRef } from 'src/core/public';
+import { I18nProvider } from '@kbn/i18n/react';
+
+import {
+  createKibanaReactContext,
+  toMountPoint,
+  IndexPattern,
+  DataPublicPluginStart,
+} from './shared_imports';
+
+import { CloseEditor, IndexPatternEditorContext, IndexPatternEditorProps } from './types';
+import { IndexPatternEditorLazy } from './components/index_pattern_editor_lazy';
+
+interface Dependencies {
+  core: CoreStart;
+  indexPatternService: DataPublicPluginStart['indexPatterns'];
+}
+
+export const getEditorOpener = ({ core, indexPatternService }: Dependencies) => (
+  options: IndexPatternEditorProps
+): CloseEditor => {
+  const { uiSettings, overlays, docLinks, notifications, http, application } = core;
+  const {
+    Provider: KibanaReactContextProvider,
+  } = createKibanaReactContext<IndexPatternEditorContext>({
+    uiSettings,
+    docLinks,
+    http,
+    notifications,
+    application,
+    indexPatternService,
+  });
+
+  let overlayRef: OverlayRef | null = null;
+
+  const openEditor = ({
+    onSave,
+    onCancel = () => {},
+    defaultTypeIsRollup = false,
+    requireTimestampField = false,
+  }: IndexPatternEditorProps): CloseEditor => {
+    const closeEditor = () => {
+      if (overlayRef) {
+        overlayRef.close();
+        overlayRef = null;
+      }
+    };
+
+    const onSaveIndexPattern = (indexPattern: IndexPattern) => {
+      closeEditor();
+
+      if (onSave) {
+        onSave(indexPattern);
+      }
+    };
+
+    overlayRef = overlays.openFlyout(
+      toMountPoint(
+        <KibanaReactContextProvider>
+          <I18nProvider>
+            <IndexPatternEditorLazy
+              onSave={onSaveIndexPattern}
+              onCancel={() => {
+                closeEditor();
+                onCancel();
+              }}
+              defaultTypeIsRollup={defaultTypeIsRollup}
+              requireTimestampField={requireTimestampField}
+            />
+          </I18nProvider>
+        </KibanaReactContextProvider>
+      ),
+      {
+        hideCloseButton: true,
+        size: 'l',
+      }
+    );
+
+    return closeEditor;
+  };
+
+  return openEditor(options);
+};
diff --git a/src/plugins/index_pattern_editor/public/plugin.test.tsx b/src/plugins/index_pattern_editor/public/plugin.test.tsx
new file mode 100644
index 00000000000000..b11d6b0c176b64
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/plugin.test.tsx
@@ -0,0 +1,83 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import React from 'react';
+
+jest.mock('../../kibana_react/public', () => {
+  const original = jest.requireActual('../../kibana_react/public');
+
+  return {
+    ...original,
+    toMountPoint: (node: React.ReactNode) => node,
+  };
+});
+
+import { CoreStart } from 'src/core/public';
+import { coreMock } from 'src/core/public/mocks';
+import { dataPluginMock } from '../../data/public/mocks';
+import { usageCollectionPluginMock } from '../../usage_collection/public/mocks';
+
+import { IndexPatternEditorLazy } from './components/index_pattern_editor_lazy';
+import { IndexPatternEditorPlugin } from './plugin';
+
+const noop = () => {};
+
+describe('IndexPatternEditorPlugin', () => {
+  const coreStart: CoreStart = coreMock.createStart();
+  const pluginStart = {
+    data: dataPluginMock.createStartContract(),
+    usageCollection: usageCollectionPluginMock.createSetupContract(),
+  };
+
+  let plugin: IndexPatternEditorPlugin;
+
+  beforeEach(() => {
+    plugin = new IndexPatternEditorPlugin();
+  });
+
+  test('should expose a handler to open the indexpattern field editor', async () => {
+    const startApi = await plugin.start(coreStart, pluginStart);
+    expect(startApi.openEditor).toBeDefined();
+  });
+
+  test('should call core.overlays.openFlyout when opening the editor', async () => {
+    const openFlyout = jest.fn();
+    const onSaveSpy = jest.fn();
+
+    const coreStartMocked = {
+      ...coreStart,
+      overlays: {
+        ...coreStart.overlays,
+        openFlyout,
+      },
+    };
+    const { openEditor } = await plugin.start(coreStartMocked, pluginStart);
+
+    openEditor({ onSave: onSaveSpy });
+
+    expect(openFlyout).toHaveBeenCalled();
+
+    const [[arg]] = openFlyout.mock.calls;
+    const i18nProvider = arg.props.children;
+    expect(i18nProvider.props.children.type).toBe(IndexPatternEditorLazy);
+
+    // We force call the "onSave" prop from the <RuntimeFieldEditorFlyoutContent /> component
+    // and make sure that the the spy is being called.
+    // Note: we are testing implementation details, if we change or rename the "onSave" prop on
+    // the component, we will need to update this test accordingly.
+    expect(i18nProvider.props.children.props.onSave).toBeDefined();
+    i18nProvider.props.children.props.onSave();
+    expect(onSaveSpy).toHaveBeenCalled();
+  });
+
+  test('should return a handler to close the flyout', async () => {
+    const { openEditor } = await plugin.start(coreStart, pluginStart);
+
+    const closeEditorHandler = openEditor({ onSave: noop });
+    expect(typeof closeEditorHandler).toBe('function');
+  });
+});
diff --git a/src/plugins/index_pattern_editor/public/plugin.tsx b/src/plugins/index_pattern_editor/public/plugin.tsx
new file mode 100644
index 00000000000000..ca72249496e777
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/plugin.tsx
@@ -0,0 +1,76 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { Plugin, CoreSetup, CoreStart } from 'src/core/public';
+
+import {
+  PluginSetup,
+  PluginStart,
+  SetupPlugins,
+  StartPlugins,
+  IndexPatternEditorProps,
+} from './types';
+import { getEditorOpener } from './open_editor';
+import { IndexPatternEditor } from './components/index_pattern_editor';
+
+export class IndexPatternEditorPlugin
+  implements Plugin<PluginSetup, PluginStart, SetupPlugins, StartPlugins> {
+  public setup(core: CoreSetup<StartPlugins, PluginStart>, plugins: SetupPlugins): PluginSetup {
+    return {};
+  }
+
+  public start(core: CoreStart, plugins: StartPlugins) {
+    const { application, uiSettings, docLinks, http, notifications } = core;
+    const { data } = plugins;
+
+    return {
+      /**
+       * Index pattern editor flyout via function interface
+       * @param IndexPatternEditorProps - index pattern editor config
+       * @returns method to close editor
+       */
+      openEditor: getEditorOpener({
+        core,
+        indexPatternService: data.indexPatterns,
+      }),
+      /**
+       * Index pattern editor flyout via react component
+       * @param IndexPatternEditorProps - index pattern editor config
+       * @returns JSX.Element
+       */
+      IndexPatternEditorComponent: (props: IndexPatternEditorProps) => (
+        <IndexPatternEditor
+          services={{
+            uiSettings,
+            docLinks,
+            http,
+            notifications,
+            application,
+            indexPatternService: data.indexPatterns,
+          }}
+          {...props}
+        />
+      ),
+      /**
+       * Convenience method to determine whether the user can create or edit edit the index patterns.
+       *
+       * @returns boolean
+       */
+      userPermissions: {
+        editIndexPattern: () => {
+          return application.capabilities.management.kibana.indexPatterns;
+        },
+      },
+    };
+  }
+
+  public stop() {
+    return {};
+  }
+}
diff --git a/src/plugins/index_pattern_editor/public/shared_imports.ts b/src/plugins/index_pattern_editor/public/shared_imports.ts
new file mode 100644
index 00000000000000..c99d32e0c8a28a
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/shared_imports.ts
@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export {
+  IndexPattern,
+  IndexPatternField,
+  DataPublicPluginStart,
+  IndexPatternSpec,
+  GetFieldsOptions,
+  IndexPatternAggRestrictions,
+} from '../../data/public';
+
+export {
+  createKibanaReactContext,
+  toMountPoint,
+  CodeEditor,
+  useKibana,
+} from '../../kibana_react/public';
+
+export {
+  useForm,
+  useFormData,
+  useFormContext,
+  Form,
+  FormSchema,
+  UseField,
+  FormHook,
+  ValidationFunc,
+  FieldConfig,
+  getFieldValidityAndErrorMessage,
+  ValidationConfig,
+} from '../../es_ui_shared/static/forms/hook_form_lib';
+
+export { fieldValidators } from '../../es_ui_shared/static/forms/helpers';
+
+export {
+  TextField,
+  ToggleField,
+  NumericField,
+  SelectField,
+  FormRow,
+  SuperSelectField,
+} from '../../es_ui_shared/static/forms/components';
+
+export { HttpStart } from '../../../core/public';
diff --git a/src/plugins/index_pattern_editor/public/test_utils/helpers.ts b/src/plugins/index_pattern_editor/public/test_utils/helpers.ts
new file mode 100644
index 00000000000000..b55a59df345452
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/test_utils/helpers.ts
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { act } from 'react-dom/test-utils';
+import { TestBed } from './test_utils';
+
+export const getCommonActions = (testBed: TestBed) => {
+  const toggleFormRow = (row: 'customLabel' | 'value' | 'format', value: 'on' | 'off' = 'on') => {
+    const testSubj = `${row}Row.toggle`;
+    const toggle = testBed.find(testSubj);
+    const isOn = toggle.props()['aria-checked'];
+
+    if ((value === 'on' && isOn) || (value === 'off' && isOn === false)) {
+      return;
+    }
+
+    testBed.form.toggleEuiSwitch(testSubj);
+  };
+
+  const changeFieldType = async (value: string, label?: string) => {
+    await act(async () => {
+      testBed.find('typeField').simulate('change', [
+        {
+          value,
+          label: label ?? value,
+        },
+      ]);
+    });
+    testBed.component.update();
+  };
+
+  return {
+    toggleFormRow,
+    changeFieldType,
+  };
+};
diff --git a/src/plugins/index_pattern_editor/public/test_utils/index.ts b/src/plugins/index_pattern_editor/public/test_utils/index.ts
new file mode 100644
index 00000000000000..b5d943281cd79b
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/test_utils/index.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export * from './test_utils';
+
+export * from './mocks';
+
+export * from './helpers';
diff --git a/src/plugins/index_pattern_editor/public/test_utils/mocks.ts b/src/plugins/index_pattern_editor/public/test_utils/mocks.ts
new file mode 100644
index 00000000000000..5d0296a04ea513
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/test_utils/mocks.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { DocLinksStart } from 'src/core/public';
+
+export const noop = () => {};
+
+export const docLinks: DocLinksStart = {
+  ELASTIC_WEBSITE_URL: 'htts://jestTest.elastic.co',
+  DOC_LINK_VERSION: 'jest',
+  links: {} as any,
+};
diff --git a/src/plugins/index_pattern_editor/public/test_utils/test_utils.ts b/src/plugins/index_pattern_editor/public/test_utils/test_utils.ts
new file mode 100644
index 00000000000000..c8e4aedc264716
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/test_utils/test_utils.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { getRandomString } from '@kbn/test/jest';
+
+export { registerTestBed, TestBed } from '@kbn/test/jest';
diff --git a/src/plugins/index_pattern_editor/public/types.ts b/src/plugins/index_pattern_editor/public/types.ts
new file mode 100644
index 00000000000000..2a2abe249b3308
--- /dev/null
+++ b/src/plugins/index_pattern_editor/public/types.ts
@@ -0,0 +1,184 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { FC } from 'react';
+import {
+  ApplicationStart,
+  IUiSettingsClient,
+  NotificationsStart,
+  DocLinksStart,
+  HttpSetup,
+} from 'src/core/public';
+
+import { EuiComboBoxOptionOption } from '@elastic/eui';
+
+import type { IndexPattern } from 'src/plugins/data/public';
+import { DataPublicPluginStart, IndexPatternAggRestrictions } from './shared_imports';
+
+export interface IndexPatternEditorContext {
+  uiSettings: IUiSettingsClient;
+  docLinks: DocLinksStart;
+  http: HttpSetup;
+  notifications: NotificationsStart;
+  application: ApplicationStart;
+  indexPatternService: DataPublicPluginStart['indexPatterns'];
+}
+
+/** @public */
+export interface IndexPatternEditorProps {
+  /**
+   * Handler for the "save" footer button
+   * @param indexPattern - newly created index pattern
+   */
+  onSave: (indexPattern: IndexPattern) => void;
+  /**
+   * Handler for the "cancel" footer button
+   */
+  onCancel?: () => void;
+  /**
+   * Sets the default index pattern type to rollup. Defaults to false.
+   */
+  defaultTypeIsRollup?: boolean;
+  /**
+   * Sets whether a timestamp field is required to create an index pattern. Defaults to false.
+   */
+  requireTimestampField?: boolean;
+}
+
+// eslint-disable-next-line @typescript-eslint/no-empty-interface
+export interface PluginSetup {}
+
+export interface PluginStart {
+  openEditor(options: IndexPatternEditorProps): () => void;
+  IndexPatternEditorComponent: FC<IndexPatternEditorProps>;
+  userPermissions: {
+    editIndexPattern: () => boolean;
+  };
+}
+
+// eslint-disable-next-line @typescript-eslint/no-empty-interface
+export interface SetupPlugins {}
+
+export interface StartPlugins {
+  data: DataPublicPluginStart;
+}
+
+export type CloseEditor = () => void;
+
+export interface MatchedItem {
+  name: string;
+  tags: Tag[];
+  item: {
+    name: string;
+    backing_indices?: string[];
+    timestamp_field?: string;
+    indices?: string[];
+    aliases?: string[];
+    attributes?: ResolveIndexResponseItemIndexAttrs[];
+    data_stream?: string;
+  };
+}
+
+// for showing index matches
+export interface ResolveIndexResponse {
+  indices?: ResolveIndexResponseItemIndex[];
+  aliases?: ResolveIndexResponseItemAlias[];
+  data_streams?: ResolveIndexResponseItemDataStream[];
+}
+
+export interface ResolveIndexResponseItem {
+  name: string;
+}
+
+export interface ResolveIndexResponseItemDataStream extends ResolveIndexResponseItem {
+  backing_indices: string[];
+  timestamp_field: string;
+}
+
+export interface ResolveIndexResponseItemAlias extends ResolveIndexResponseItem {
+  indices: string[];
+}
+
+export interface ResolveIndexResponseItemIndex extends ResolveIndexResponseItem {
+  aliases?: string[];
+  attributes?: ResolveIndexResponseItemIndexAttrs[];
+  data_stream?: string;
+}
+
+export interface Tag {
+  name: string;
+  key: string;
+  color: string;
+}
+// end for index matches
+
+export interface IndexPatternTableItem {
+  id: string;
+  title: string;
+  default: boolean;
+  tag?: string[];
+  sort: string;
+}
+
+// copied from index pattern management, needs review
+export interface MatchedItem {
+  name: string;
+  tags: Tag[];
+  item: {
+    name: string;
+    backing_indices?: string[];
+    timestamp_field?: string;
+    indices?: string[];
+    aliases?: string[];
+    attributes?: ResolveIndexResponseItemIndexAttrs[];
+    data_stream?: string;
+  };
+}
+
+export enum ResolveIndexResponseItemIndexAttrs {
+  OPEN = 'open',
+  CLOSED = 'closed',
+  HIDDEN = 'hidden',
+  FROZEN = 'frozen',
+}
+
+export interface RollupIndiciesCapability {
+  aggs: Record<string, IndexPatternAggRestrictions>;
+  error: string;
+}
+
+export type RollupIndicesCapsResponse = Record<string, RollupIndiciesCapability>;
+
+export enum INDEX_PATTERN_TYPE {
+  ROLLUP = 'rollup',
+  DEFAULT = 'default',
+}
+
+export interface IndexPatternConfig {
+  title: string;
+  timestampField?: EuiComboBoxOptionOption<string>;
+  allowHidden: boolean;
+  id?: string;
+  type: INDEX_PATTERN_TYPE;
+}
+
+export interface FormInternal extends Omit<IndexPatternConfig, 'timestampField'> {
+  timestampField?: TimestampOption;
+}
+
+export interface TimestampOption {
+  display: string;
+  fieldName?: string;
+}
+
+export interface MatchedIndicesSet {
+  allIndices: MatchedItem[];
+  exactMatchedIndices: MatchedItem[];
+  partialMatchedIndices: MatchedItem[];
+  visibleIndices: MatchedItem[];
+}
diff --git a/src/plugins/index_pattern_editor/tsconfig.json b/src/plugins/index_pattern_editor/tsconfig.json
new file mode 100644
index 00000000000000..559b1aaf0fc26c
--- /dev/null
+++ b/src/plugins/index_pattern_editor/tsconfig.json
@@ -0,0 +1,20 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "outDir": "./target/types",
+    "emitDeclarationOnly": true,
+    "declaration": true,
+    "declarationMap": true
+  },
+  "include": [
+    "public/**/*",
+  ],
+  "references": [
+    { "path": "../../core/tsconfig.json" },
+    { "path": "../data/tsconfig.json" },
+    { "path": "../kibana_react/tsconfig.json" },
+    { "path": "../kibana_utils/tsconfig.json" },
+    { "path": "../es_ui_shared/tsconfig.json" },
+  ]
+}
diff --git a/src/plugins/index_pattern_field_editor/kibana.json b/src/plugins/index_pattern_field_editor/kibana.json
index a3a7e61e9806e5..02308b349d4ca1 100644
--- a/src/plugins/index_pattern_field_editor/kibana.json
+++ b/src/plugins/index_pattern_field_editor/kibana.json
@@ -5,7 +5,7 @@
   "ui": true,
   "requiredPlugins": ["data"],
   "optionalPlugins": ["usageCollection"],
-  "requiredBundles": ["kibanaReact", "esUiShared", "usageCollection"],
+  "requiredBundles": ["kibanaReact", "esUiShared", "usageCollection", "fieldFormats"],
   "owner": {
     "name": "App Services",
     "githubTeam": "kibana-app-services"
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/bytes/bytes.test.tsx b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/bytes/bytes.test.tsx
index 04be866a33ca73..219a51e421b44e 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/bytes/bytes.test.tsx
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/bytes/bytes.test.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 import { shallow } from 'enzyme';
 import { coreMock } from 'src/core/public/mocks';
 import { createKibanaReactContext } from '../../../../../../kibana_react/public';
-import { FieldFormat } from 'src/plugins/data/public';
+import { FieldFormat } from 'src/plugins/field_formats/common';
 
 import { BytesFormatEditor } from './bytes';
 
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/color/color.test.tsx b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/color/color.test.tsx
index 1026012f3b8878..4b0df63261496d 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/color/color.test.tsx
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/color/color.test.tsx
@@ -8,17 +8,16 @@
 
 import React from 'react';
 import { shallowWithI18nProvider } from '@kbn/test/jest';
-import { FieldFormat } from 'src/plugins/data/public';
 
 import { ColorFormatEditor } from './color';
-import { fieldFormats } from '../../../../../../data/public';
+import { FieldFormat, DEFAULT_CONVERTER_COLOR } from '../../../../../../field_formats/common';
 
 const fieldType = 'string';
 const format = {
   getConverterFor: jest.fn(),
 };
 const formatParams = {
-  colors: [{ ...fieldFormats.DEFAULT_CONVERTER_COLOR }],
+  colors: [{ ...DEFAULT_CONVERTER_COLOR }],
 };
 const onChange = jest.fn();
 const onError = jest.fn();
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/color/color.tsx b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/color/color.tsx
index 3570ef4c9d33a6..67290212c04ddc 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/color/color.tsx
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/color/color.tsx
@@ -15,7 +15,7 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import { DefaultFormatEditor } from '../default/default';
 import { formatId } from './constants';
 
-import { fieldFormats } from '../../../../../../data/public';
+import { DEFAULT_CONVERTER_COLOR } from '../../../../../../field_formats/common';
 import { FormatEditorProps } from '../types';
 
 interface Color {
@@ -56,7 +56,7 @@ export class ColorFormatEditor extends DefaultFormatEditor<ColorFormatEditorForm
   addColor = () => {
     const colors = [...(this.props.formatParams.colors || [])];
     this.onChange({
-      colors: [...colors, { ...fieldFormats.DEFAULT_CONVERTER_COLOR }],
+      colors: [...colors, { ...DEFAULT_CONVERTER_COLOR }],
     });
   };
 
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/date/date.test.tsx b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/date/date.test.tsx
index f3f46cbbdda31c..348ac86e209eae 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/date/date.test.tsx
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/date/date.test.tsx
@@ -8,7 +8,7 @@
 
 import React from 'react';
 import { shallow } from 'enzyme';
-import { FieldFormat } from 'src/plugins/data/public';
+import type { FieldFormat } from 'src/plugins/field_formats/common';
 
 import { DateFormatEditor } from './date';
 
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/date_nanos/date_nanos.test.tsx b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/date_nanos/date_nanos.test.tsx
index 4e8d56f91c6eb1..8fc4f4dbdfdb61 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/date_nanos/date_nanos.test.tsx
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/date_nanos/date_nanos.test.tsx
@@ -8,7 +8,7 @@
 
 import React from 'react';
 import { shallow } from 'enzyme';
-import type { FieldFormat } from 'src/plugins/data/public';
+import type { FieldFormat } from 'src/plugins/field_formats/common';
 
 import { DateNanosFormatEditor } from './date_nanos';
 
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/default/default.test.tsx b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/default/default.test.tsx
index 90f1d43fa357a3..c56d1c0261ed1c 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/default/default.test.tsx
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/default/default.test.tsx
@@ -8,7 +8,7 @@
 
 import React from 'react';
 import { shallow } from 'enzyme';
-import { FieldFormat } from 'src/plugins/data/public';
+import { FieldFormat } from 'src/plugins/field_formats/common';
 
 import { SampleInput } from '../../types';
 import { DefaultFormatEditor, convertSampleInput } from './default';
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/default/default.tsx b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/default/default.tsx
index 7228a02afa2a5c..129049e1b05657 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/default/default.tsx
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/default/default.tsx
@@ -9,7 +9,7 @@
 import React, { PureComponent, ReactText } from 'react';
 import { i18n } from '@kbn/i18n';
 
-import { FieldFormatsContentType } from 'src/plugins/data/public';
+import type { FieldFormatsContentType } from 'src/plugins/field_formats/common';
 import { Sample, SampleInput } from '../../types';
 import { FormatEditorProps } from '../types';
 import { formatId } from './constants';
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/duration/duration.test.tsx b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/duration/duration.test.tsx
index 80a57b94197638..dbc369126d64e6 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/duration/duration.test.tsx
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/duration/duration.test.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 import { shallow } from 'enzyme';
 
 import { DurationFormatEditor } from './duration';
-import { FieldFormat } from 'src/plugins/data/public';
+import { FieldFormat } from 'src/plugins/field_formats/common';
 import { EuiSwitch } from '@elastic/eui';
 
 const fieldType = 'number';
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/duration/duration.tsx b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/duration/duration.tsx
index 2bfb0182cbb880..89bac89a95b768 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/duration/duration.tsx
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/duration/duration.tsx
@@ -7,7 +7,7 @@
  */
 
 import React, { Fragment } from 'react';
-import { DurationFormat } from 'src/plugins/data/common';
+import { DurationFormat } from 'src/plugins/field_formats/common';
 
 import { EuiFieldNumber, EuiFormRow, EuiSelect, EuiSwitch } from '@elastic/eui';
 
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/histogram/histogram.test.tsx b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/histogram/histogram.test.tsx
index 053dff12139086..4c34af8748f599 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/histogram/histogram.test.tsx
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/histogram/histogram.test.tsx
@@ -8,7 +8,7 @@
 
 import React from 'react';
 import { shallow } from 'enzyme';
-import { FieldFormat } from 'src/plugins/data/public';
+import type { FieldFormat } from 'src/plugins/field_formats/common';
 
 import { HistogramFormatEditor } from './histogram';
 
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/number/number.test.tsx b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/number/number.test.tsx
index ad71263978d9c9..1554da93dac532 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/number/number.test.tsx
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/number/number.test.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 import { shallow } from 'enzyme';
 import { coreMock } from 'src/core/public/mocks';
 import { createKibanaReactContext } from '../../../../../../kibana_react/public';
-import { FieldFormat } from 'src/plugins/data/public';
+import { FieldFormat } from 'src/plugins/field_formats/common';
 
 import { NumberFormatEditor } from './number';
 
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/percent/percent.test.tsx b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/percent/percent.test.tsx
index 6f6a88cfb7c955..ef71055deca7ba 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/percent/percent.test.tsx
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/percent/percent.test.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 import { shallow } from 'enzyme';
 import { coreMock } from 'src/core/public/mocks';
 import { createKibanaReactContext } from '../../../../../../kibana_react/public';
-import { FieldFormat } from 'src/plugins/data/public';
+import { FieldFormat } from 'src/plugins/field_formats/common';
 
 import { PercentFormatEditor } from './percent';
 
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/static_lookup/static_lookup.test.tsx b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/static_lookup/static_lookup.test.tsx
index 8d9cb17b33a403..68a65e5a0fa6cb 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/static_lookup/static_lookup.test.tsx
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/static_lookup/static_lookup.test.tsx
@@ -9,7 +9,7 @@
 import React from 'react';
 import { shallowWithI18nProvider } from '@kbn/test/jest';
 import { StaticLookupFormatEditorFormatParams } from './static_lookup';
-import { FieldFormat } from 'src/plugins/data/public';
+import { FieldFormat } from 'src/plugins/field_formats/common';
 
 import { StaticLookupFormatEditor } from './static_lookup';
 
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/string/string.test.tsx b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/string/string.test.tsx
index 5b573d938ebb28..61076353dbf5e0 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/string/string.test.tsx
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/string/string.test.tsx
@@ -8,7 +8,7 @@
 
 import React from 'react';
 import { shallow } from 'enzyme';
-import { FieldFormat } from 'src/plugins/data/public';
+import { FieldFormat } from 'src/plugins/field_formats/common';
 
 import { StringFormatEditor } from './string';
 
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/truncate/truncate.test.tsx b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/truncate/truncate.test.tsx
index 6a4ae0fde0c598..acba1fbedb2061 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/truncate/truncate.test.tsx
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/truncate/truncate.test.tsx
@@ -9,7 +9,7 @@
 import React, { ChangeEvent } from 'react';
 import { shallow } from 'enzyme';
 import { EuiFieldNumber } from '@elastic/eui';
-import { FieldFormat } from 'src/plugins/data/public';
+import { FieldFormat } from 'src/plugins/field_formats/common';
 
 import { TruncateFormatEditor } from './truncate';
 
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/types.ts b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/types.ts
index 556078286e5243..cbdd8efb2a4c87 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/types.ts
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/types.ts
@@ -7,7 +7,7 @@
  */
 
 import type { ComponentType } from 'react';
-import type { FieldFormat } from '../../../../../data/common';
+import type { FieldFormat } from '../../../../../field_formats/common';
 import type { FormatSelectEditorProps } from '../field_format_editor';
 
 /**
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/url/url.test.tsx b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/url/url.test.tsx
index 1000d9d2b86505..79dc63230dc33d 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/url/url.test.tsx
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/url/url.test.tsx
@@ -7,7 +7,7 @@
  */
 
 import React from 'react';
-import { FieldFormat } from 'src/plugins/data/public';
+import type { FieldFormat } from 'src/plugins/field_formats/common';
 import { __IntlProvider as IntlProvider } from '@kbn/i18n/react';
 import { UrlFormatEditor } from './url';
 import { coreMock } from 'src/core/public/mocks';
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/field_format_editor.tsx b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/field_format_editor.tsx
index ccb6cf7794f871..1c0c7ecba3b2bc 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/field_format_editor.tsx
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/field_format_editor.tsx
@@ -12,12 +12,12 @@ import { EuiCode, EuiFormRow, EuiSelect } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
 import {
-  FieldFormatInstanceType,
   IndexPattern,
   KBN_FIELD_TYPES,
   ES_FIELD_TYPES,
   DataPublicPluginStart,
 } from 'src/plugins/data/public';
+import type { FieldFormatInstanceType } from 'src/plugins/field_formats/common';
 import { CoreStart } from 'src/core/public';
 import { castEsToKbnFieldTypeName } from '../../../../data/public';
 import { FormatEditor } from './format_editor';
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/format_editor.tsx b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/format_editor.tsx
index dbbaf51f114b11..c6f5fc9899ac7d 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/format_editor.tsx
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/format_editor.tsx
@@ -9,7 +9,7 @@
 import { EuiDelayRender, EuiLoadingContent } from '@elastic/eui';
 import { memoize } from 'lodash';
 import React, { PureComponent, LazyExoticComponent } from 'react';
-import type { FieldFormat } from 'src/plugins/data/public';
+import type { FieldFormat } from 'src/plugins/field_formats/common';
 import { FieldFormatEditorFactory, FieldFormatEditor } from './editors';
 
 export interface FormatEditorProps {
diff --git a/src/plugins/index_pattern_field_editor/public/shared_imports.ts b/src/plugins/index_pattern_field_editor/public/shared_imports.ts
index 9caa5e093a96f1..cfc36543780c18 100644
--- a/src/plugins/index_pattern_field_editor/public/shared_imports.ts
+++ b/src/plugins/index_pattern_field_editor/public/shared_imports.ts
@@ -6,12 +6,7 @@
  * Side Public License, v 1.
  */
 
-export {
-  IndexPattern,
-  IndexPatternField,
-  DataPublicPluginStart,
-  FieldFormat,
-} from '../../data/public';
+export { IndexPattern, IndexPatternField, DataPublicPluginStart } from '../../data/public';
 
 export { UsageCollectionStart } from '../../usage_collection/public';
 
@@ -19,6 +14,8 @@ export { RuntimeType, RuntimeField, KBN_FIELD_TYPES, ES_FIELD_TYPES } from '../.
 
 export { createKibanaReactContext, toMountPoint, CodeEditor } from '../../kibana_react/public';
 
+export { FieldFormat } from '../../field_formats/common';
+
 export {
   useForm,
   useFormData,
diff --git a/src/plugins/index_pattern_field_editor/tsconfig.json b/src/plugins/index_pattern_field_editor/tsconfig.json
index 559b1aaf0fc26c..5450ae74a91a05 100644
--- a/src/plugins/index_pattern_field_editor/tsconfig.json
+++ b/src/plugins/index_pattern_field_editor/tsconfig.json
@@ -16,5 +16,6 @@
     { "path": "../kibana_react/tsconfig.json" },
     { "path": "../kibana_utils/tsconfig.json" },
     { "path": "../es_ui_shared/tsconfig.json" },
+    { "path": "../field_formats/tsconfig.json" }
   ]
 }
diff --git a/src/plugins/index_pattern_management/kibana.json b/src/plugins/index_pattern_management/kibana.json
index 7d9d885bbf9d63..3ba56eda3620e8 100644
--- a/src/plugins/index_pattern_management/kibana.json
+++ b/src/plugins/index_pattern_management/kibana.json
@@ -3,7 +3,7 @@
   "version": "kibana",
   "server": true,
   "ui": true,
-  "requiredPlugins": ["management", "data", "urlForwarding", "indexPatternFieldEditor"],
+  "requiredPlugins": ["management", "data", "urlForwarding", "indexPatternFieldEditor", "indexPatternEditor"],
   "requiredBundles": ["kibanaReact", "kibanaUtils"],
   "owner": {
     "name": "App Services",
diff --git a/src/plugins/index_pattern_management/public/components/__snapshots__/utils.test.ts.snap b/src/plugins/index_pattern_management/public/components/__snapshots__/utils.test.ts.snap
index 224a5c992d58b3..3a25a78472b502 100644
--- a/src/plugins/index_pattern_management/public/components/__snapshots__/utils.test.ts.snap
+++ b/src/plugins/index_pattern_management/public/components/__snapshots__/utils.test.ts.snap
@@ -6,14 +6,19 @@ Array [
     "default": true,
     "id": "test",
     "sort": "0test name",
-    "tags": undefined,
+    "tags": Array [
+      Object {
+        "key": "default",
+        "name": "Default",
+      },
+    ],
     "title": "test name",
   },
   Object {
     "default": false,
     "id": "test1",
     "sort": "1test name 1",
-    "tags": undefined,
+    "tags": Array [],
     "title": "test name 1",
   },
 ]
diff --git a/src/plugins/index_pattern_management/public/components/create_button/create_button.tsx b/src/plugins/index_pattern_management/public/components/create_button/create_button.tsx
deleted file mode 100644
index 0da250f5cba3bf..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_button/create_button.tsx
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-// @ts-ignore
-import { euiColorAccent } from '@elastic/eui/dist/eui_theme_light.json';
-import React, { Component, Fragment } from 'react';
-
-import {
-  EuiBadge,
-  EuiButton,
-  EuiContextMenuItem,
-  EuiContextMenuPanel,
-  EuiDescriptionList,
-  EuiDescriptionListDescription,
-  EuiDescriptionListTitle,
-  EuiPopover,
-} from '@elastic/eui';
-
-import { FormattedMessage } from '@kbn/i18n/react';
-
-interface State {
-  isPopoverOpen: boolean;
-}
-
-interface Props {
-  options: Array<{
-    text: string;
-    description?: string;
-    testSubj?: string;
-    isBeta?: boolean;
-    onClick: () => void;
-  }>;
-}
-
-export class CreateButton extends Component<Props, State> {
-  public state = {
-    isPopoverOpen: false,
-  };
-
-  public render() {
-    const { options, children } = this.props;
-    const { isPopoverOpen } = this.state;
-
-    if (!options || !options.length) {
-      return null;
-    }
-
-    if (options.length === 1) {
-      return (
-        <EuiButton
-          data-test-subj="createIndexPatternButton"
-          fill={true}
-          onClick={options[0].onClick}
-          iconType="plusInCircle"
-        >
-          {children}
-        </EuiButton>
-      );
-    }
-
-    const button = (
-      <EuiButton
-        data-test-subj="createIndexPatternButton"
-        fill={true}
-        size="s"
-        iconType="arrowDown"
-        iconSide="right"
-        onClick={this.togglePopover}
-      >
-        {children}
-      </EuiButton>
-    );
-
-    if (options.length > 1) {
-      return (
-        <EuiPopover
-          id="singlePanel"
-          button={button}
-          isOpen={isPopoverOpen}
-          closePopover={this.closePopover}
-          panelPaddingSize="none"
-          anchorPosition="downLeft"
-        >
-          <EuiContextMenuPanel
-            items={options.map((option) => {
-              return (
-                <EuiContextMenuItem
-                  key={option.text}
-                  onClick={option.onClick}
-                  data-test-subj={option.testSubj}
-                >
-                  <EuiDescriptionList style={{ whiteSpace: 'nowrap' }}>
-                    <EuiDescriptionListTitle>
-                      {option.text}
-                      {option.isBeta ? <Fragment> {this.renderBetaBadge()}</Fragment> : null}
-                    </EuiDescriptionListTitle>
-                    <EuiDescriptionListDescription>
-                      {option.description}
-                    </EuiDescriptionListDescription>
-                  </EuiDescriptionList>
-                </EuiContextMenuItem>
-              );
-            })}
-          />
-        </EuiPopover>
-      );
-    }
-  }
-
-  private togglePopover = () => {
-    this.setState({
-      isPopoverOpen: !this.state.isPopoverOpen,
-    });
-  };
-
-  private closePopover = () => {
-    this.setState({
-      isPopoverOpen: false,
-    });
-  };
-
-  private renderBetaBadge = () => {
-    return (
-      <EuiBadge color={euiColorAccent}>
-        <FormattedMessage
-          id="indexPatternManagement.indexPatternList.createButton.betaLabel"
-          defaultMessage="Beta"
-        />
-      </EuiBadge>
-    );
-  };
-}
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/CREATE_INDEX_PATTERN.md b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/CREATE_INDEX_PATTERN.md
deleted file mode 100644
index 6e01bf001691e0..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/CREATE_INDEX_PATTERN.md
+++ /dev/null
@@ -1,15 +0,0 @@
-# Create Index Pattern
-
-This is meant to serve as a guide to this area of code.
-
-## Bye bye regressions
-In order to prevent future regressions, there are a few scenarios
-that need to be tested with each change to this area of the code.
-
-- Cross-cluster search
-  - Ensure changes work properly in a CCS environment
-  - A solid CCS environment involves various indices on all nodes including the controlling node.
-- Alias support
-  - Indices are the most common use case, but we also support aliases.
-- Time field name
-  - This needs to be `undefined` if the user does not select one (other areas of Kibana depend on this)
\ No newline at end of file
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/__snapshots__/create_index_pattern_wizard.test.tsx.snap b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/__snapshots__/create_index_pattern_wizard.test.tsx.snap
deleted file mode 100644
index 38a9e470144168..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/__snapshots__/create_index_pattern_wizard.test.tsx.snap
+++ /dev/null
@@ -1,250 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`CreateIndexPatternWizard defaults to the loading state 1`] = `
-<Fragment>
-  <LoadingState />
-  <EuiGlobalToastList
-    dismissToast={[Function]}
-    side="right"
-    toastLifeTimeMs={6000}
-    toasts={Array []}
-  />
-</Fragment>
-`;
-
-exports[`CreateIndexPatternWizard renders index pattern step when there are indices 1`] = `
-<Fragment>
-  <Header
-    docLinks={
-      Object {
-        "DOC_LINK_VERSION": "jest",
-        "ELASTIC_WEBSITE_URL": "htts://jestTest.elastic.co",
-        "links": Object {
-          "indexPatterns": Object {},
-          "runtimeFields": Object {},
-          "scriptedFields": Object {},
-        },
-      }
-    }
-    indexPatternName="name"
-    isBeta={false}
-    prompt={null}
-  />
-  <EuiSpacer
-    size="l"
-  />
-  <StepIndexPattern
-    allIndices={
-      Array [
-        Object {
-          "name": "myIndexPattern",
-        },
-      ]
-    }
-    goToNextStep={[Function]}
-    indexPatternCreationType={
-      IndexPatternCreationConfig {
-        "httpClient": null,
-        "isBeta": false,
-        "key": "default",
-        "name": "name",
-        "showSystemIndices": true,
-        "type": "default",
-      }
-    }
-    showSystemIndices={true}
-  />
-  <EuiGlobalToastList
-    dismissToast={[Function]}
-    side="right"
-    toastLifeTimeMs={6000}
-    toasts={Array []}
-  />
-</Fragment>
-`;
-
-exports[`CreateIndexPatternWizard renders the empty state when there are no indices 1`] = `
-<Fragment>
-  <Header
-    docLinks={
-      Object {
-        "DOC_LINK_VERSION": "jest",
-        "ELASTIC_WEBSITE_URL": "htts://jestTest.elastic.co",
-        "links": Object {
-          "indexPatterns": Object {},
-          "runtimeFields": Object {},
-          "scriptedFields": Object {},
-        },
-      }
-    }
-    indexPatternName="name"
-    isBeta={false}
-    prompt={null}
-  />
-  <EuiSpacer
-    size="l"
-  />
-  <StepIndexPattern
-    allIndices={Array []}
-    goToNextStep={[Function]}
-    indexPatternCreationType={
-      IndexPatternCreationConfig {
-        "httpClient": null,
-        "isBeta": false,
-        "key": "default",
-        "name": "name",
-        "showSystemIndices": true,
-        "type": "default",
-      }
-    }
-    showSystemIndices={true}
-  />
-  <EuiGlobalToastList
-    dismissToast={[Function]}
-    side="right"
-    toastLifeTimeMs={6000}
-    toasts={Array []}
-  />
-</Fragment>
-`;
-
-exports[`CreateIndexPatternWizard renders time field step when step is set to 2 1`] = `
-<Fragment>
-  <Header
-    docLinks={
-      Object {
-        "DOC_LINK_VERSION": "jest",
-        "ELASTIC_WEBSITE_URL": "htts://jestTest.elastic.co",
-        "links": Object {
-          "indexPatterns": Object {},
-          "runtimeFields": Object {},
-          "scriptedFields": Object {},
-        },
-      }
-    }
-    indexPatternName="name"
-    isBeta={false}
-    prompt={null}
-  />
-  <EuiSpacer
-    size="l"
-  />
-  <StepTimeField
-    createIndexPattern={[Function]}
-    goToPreviousStep={[Function]}
-    indexPattern=""
-    indexPatternCreationType={
-      IndexPatternCreationConfig {
-        "httpClient": null,
-        "isBeta": false,
-        "key": "default",
-        "name": "name",
-        "showSystemIndices": true,
-        "type": "default",
-      }
-    }
-  />
-  <EuiGlobalToastList
-    dismissToast={[Function]}
-    side="right"
-    toastLifeTimeMs={6000}
-    toasts={Array []}
-  />
-</Fragment>
-`;
-
-exports[`CreateIndexPatternWizard renders when there are no indices but there are remote clusters 1`] = `
-<Fragment>
-  <Header
-    docLinks={
-      Object {
-        "DOC_LINK_VERSION": "jest",
-        "ELASTIC_WEBSITE_URL": "htts://jestTest.elastic.co",
-        "links": Object {
-          "indexPatterns": Object {},
-          "runtimeFields": Object {},
-          "scriptedFields": Object {},
-        },
-      }
-    }
-    indexPatternName="name"
-    isBeta={false}
-    prompt={null}
-  />
-  <EuiSpacer
-    size="l"
-  />
-  <StepIndexPattern
-    allIndices={Array []}
-    goToNextStep={[Function]}
-    indexPatternCreationType={
-      IndexPatternCreationConfig {
-        "httpClient": null,
-        "isBeta": false,
-        "key": "default",
-        "name": "name",
-        "showSystemIndices": true,
-        "type": "default",
-      }
-    }
-    showSystemIndices={true}
-  />
-  <EuiGlobalToastList
-    dismissToast={[Function]}
-    side="right"
-    toastLifeTimeMs={6000}
-    toasts={Array []}
-  />
-</Fragment>
-`;
-
-exports[`CreateIndexPatternWizard shows system indices even if there are no other indices if the include system indices is toggled 1`] = `
-<Fragment>
-  <Header
-    docLinks={
-      Object {
-        "DOC_LINK_VERSION": "jest",
-        "ELASTIC_WEBSITE_URL": "htts://jestTest.elastic.co",
-        "links": Object {
-          "indexPatterns": Object {},
-          "runtimeFields": Object {},
-          "scriptedFields": Object {},
-        },
-      }
-    }
-    indexPatternName="name"
-    isBeta={false}
-    prompt={null}
-  />
-  <EuiSpacer
-    size="l"
-  />
-  <StepIndexPattern
-    allIndices={
-      Array [
-        Object {
-          "name": ".kibana ",
-        },
-      ]
-    }
-    goToNextStep={[Function]}
-    indexPatternCreationType={
-      IndexPatternCreationConfig {
-        "httpClient": null,
-        "isBeta": false,
-        "key": "default",
-        "name": "name",
-        "showSystemIndices": true,
-        "type": "default",
-      }
-    }
-    showSystemIndices={true}
-  />
-  <EuiGlobalToastList
-    dismissToast={[Function]}
-    side="right"
-    toastLifeTimeMs={6000}
-    toasts={Array []}
-  />
-</Fragment>
-`;
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/header/__snapshots__/header.test.tsx.snap b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/header/__snapshots__/header.test.tsx.snap
deleted file mode 100644
index 5e5fbb7c5e99d5..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/header/__snapshots__/header.test.tsx.snap
+++ /dev/null
@@ -1,499 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`Header should render a different name, prompt, and beta tag if provided 1`] = `
-<Header
-  docLinks={
-    Object {
-      "links": Object {
-        "indexPatterns": Object {},
-      },
-    }
-  }
-  indexPatternName="test index pattern"
-  isBeta={true}
-  prompt={
-    <div>
-      Test prompt
-    </div>
-  }
->
-  <EuiPageHeader
-    bottomBorder={true}
-    pageTitle={
-      <React.Fragment>
-        Create test index pattern
-        <React.Fragment>
-           
-          <EuiBetaBadge
-            label="Beta"
-          />
-        </React.Fragment>
-      </React.Fragment>
-    }
-  >
-    <header
-      className="euiPageHeader euiPageHeader--bottomBorder euiPageHeader--responsive euiPageHeader--center"
-    >
-      <EuiPageHeaderContent
-        pageTitle={
-          <React.Fragment>
-            Create test index pattern
-            <React.Fragment>
-               
-              <EuiBetaBadge
-                label="Beta"
-              />
-            </React.Fragment>
-          </React.Fragment>
-        }
-        responsive={true}
-      >
-        <div
-          className="euiPageHeaderContent"
-        >
-          <EuiFlexGroup
-            alignItems="flexStart"
-            className="euiPageHeaderContent__top"
-            gutterSize="l"
-            responsive={true}
-          >
-            <div
-              className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--alignItemsFlexStart euiFlexGroup--directionRow euiFlexGroup--responsive euiPageHeaderContent__top"
-            >
-              <EuiFlexItem>
-                <div
-                  className="euiFlexItem"
-                >
-                  <EuiTitle
-                    size="l"
-                  >
-                    <h1
-                      className="euiTitle euiTitle--large"
-                    >
-                      Create test index pattern
-                       
-                      <EuiBetaBadge
-                        label="Beta"
-                      >
-                        <span
-                          className="euiBetaBadge euiBetaBadge--hollow"
-                          title="Beta"
-                        >
-                          Beta
-                        </span>
-                      </EuiBetaBadge>
-                    </h1>
-                  </EuiTitle>
-                </div>
-              </EuiFlexItem>
-            </div>
-          </EuiFlexGroup>
-          <div
-            className="euiPageHeaderContent__bottom"
-          >
-            <EuiSpacer>
-              <div
-                className="euiSpacer euiSpacer--l"
-              />
-            </EuiSpacer>
-            <EuiText>
-              <div
-                className="euiText euiText--medium"
-              >
-                <p>
-                  <FormattedMessage
-                    defaultMessage="An index pattern can match a single source, for example, {single}, or {multiple} data sources, {star}."
-                    id="indexPatternManagement.createIndexPattern.description"
-                    values={
-                      Object {
-                        "multiple": <strong>
-                          multiple
-                        </strong>,
-                        "single": <EuiCode>
-                          filebeat-4-3-22
-                        </EuiCode>,
-                        "star": <EuiCode>
-                          filebeat-*
-                        </EuiCode>,
-                      }
-                    }
-                  >
-                    <span>
-                      An index pattern can match a single source, for example, 
-                      <EuiCode>
-                        <EuiCodeBlockImpl
-                          inline={true}
-                        >
-                          <span>
-                            <code>
-                              filebeat-4-3-22
-                            </code>
-                          </span>
-                        </EuiCodeBlockImpl>
-                      </EuiCode>
-                      , or 
-                      <strong>
-                        multiple
-                      </strong>
-                       data sources, 
-                      <EuiCode>
-                        <EuiCodeBlockImpl
-                          inline={true}
-                        >
-                          <span>
-                            <code>
-                              filebeat-*
-                            </code>
-                          </span>
-                        </EuiCodeBlockImpl>
-                      </EuiCode>
-                      .
-                    </span>
-                  </FormattedMessage>
-                  <br />
-                  <EuiLink
-                    external={true}
-                    target="_blank"
-                  >
-                    <button
-                      className="euiLink euiLink--primary"
-                      disabled={false}
-                      type="button"
-                    >
-                      <FormattedMessage
-                        defaultMessage="Read documentation"
-                        id="indexPatternManagement.createIndexPattern.documentation"
-                        values={Object {}}
-                      >
-                        <span>
-                          Read documentation
-                        </span>
-                      </FormattedMessage>
-                    </button>
-                  </EuiLink>
-                </p>
-              </div>
-            </EuiText>
-            <EuiSpacer
-              size="m"
-            >
-              <div
-                className="euiSpacer euiSpacer--m"
-              />
-            </EuiSpacer>
-            <div>
-              Test prompt
-            </div>
-          </div>
-        </div>
-      </EuiPageHeaderContent>
-    </header>
-  </EuiPageHeader>
-</Header>
-`;
-
-exports[`Header should render normally 1`] = `
-<Header
-  docLinks={
-    Object {
-      "links": Object {
-        "indexPatterns": Object {},
-      },
-    }
-  }
-  indexPatternName="test index pattern"
->
-  <EuiPageHeader
-    bottomBorder={true}
-    pageTitle={
-      <React.Fragment>
-        Create test index pattern
-      </React.Fragment>
-    }
-  >
-    <header
-      className="euiPageHeader euiPageHeader--bottomBorder euiPageHeader--responsive euiPageHeader--center"
-    >
-      <EuiPageHeaderContent
-        pageTitle={
-          <React.Fragment>
-            Create test index pattern
-          </React.Fragment>
-        }
-        responsive={true}
-      >
-        <div
-          className="euiPageHeaderContent"
-        >
-          <EuiFlexGroup
-            alignItems="flexStart"
-            className="euiPageHeaderContent__top"
-            gutterSize="l"
-            responsive={true}
-          >
-            <div
-              className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--alignItemsFlexStart euiFlexGroup--directionRow euiFlexGroup--responsive euiPageHeaderContent__top"
-            >
-              <EuiFlexItem>
-                <div
-                  className="euiFlexItem"
-                >
-                  <EuiTitle
-                    size="l"
-                  >
-                    <h1
-                      className="euiTitle euiTitle--large"
-                    >
-                      Create test index pattern
-                    </h1>
-                  </EuiTitle>
-                </div>
-              </EuiFlexItem>
-            </div>
-          </EuiFlexGroup>
-          <div
-            className="euiPageHeaderContent__bottom"
-          >
-            <EuiSpacer>
-              <div
-                className="euiSpacer euiSpacer--l"
-              />
-            </EuiSpacer>
-            <EuiText>
-              <div
-                className="euiText euiText--medium"
-              >
-                <p>
-                  <FormattedMessage
-                    defaultMessage="An index pattern can match a single source, for example, {single}, or {multiple} data sources, {star}."
-                    id="indexPatternManagement.createIndexPattern.description"
-                    values={
-                      Object {
-                        "multiple": <strong>
-                          multiple
-                        </strong>,
-                        "single": <EuiCode>
-                          filebeat-4-3-22
-                        </EuiCode>,
-                        "star": <EuiCode>
-                          filebeat-*
-                        </EuiCode>,
-                      }
-                    }
-                  >
-                    <span>
-                      An index pattern can match a single source, for example, 
-                      <EuiCode>
-                        <EuiCodeBlockImpl
-                          inline={true}
-                        >
-                          <span>
-                            <code>
-                              filebeat-4-3-22
-                            </code>
-                          </span>
-                        </EuiCodeBlockImpl>
-                      </EuiCode>
-                      , or 
-                      <strong>
-                        multiple
-                      </strong>
-                       data sources, 
-                      <EuiCode>
-                        <EuiCodeBlockImpl
-                          inline={true}
-                        >
-                          <span>
-                            <code>
-                              filebeat-*
-                            </code>
-                          </span>
-                        </EuiCodeBlockImpl>
-                      </EuiCode>
-                      .
-                    </span>
-                  </FormattedMessage>
-                  <br />
-                  <EuiLink
-                    external={true}
-                    target="_blank"
-                  >
-                    <button
-                      className="euiLink euiLink--primary"
-                      disabled={false}
-                      type="button"
-                    >
-                      <FormattedMessage
-                        defaultMessage="Read documentation"
-                        id="indexPatternManagement.createIndexPattern.documentation"
-                        values={Object {}}
-                      >
-                        <span>
-                          Read documentation
-                        </span>
-                      </FormattedMessage>
-                    </button>
-                  </EuiLink>
-                </p>
-              </div>
-            </EuiText>
-          </div>
-        </div>
-      </EuiPageHeaderContent>
-    </header>
-  </EuiPageHeader>
-</Header>
-`;
-
-exports[`Header should render without including system indices 1`] = `
-<Header
-  docLinks={
-    Object {
-      "links": Object {
-        "indexPatterns": Object {},
-      },
-    }
-  }
-  indexPatternName="test index pattern"
->
-  <EuiPageHeader
-    bottomBorder={true}
-    pageTitle={
-      <React.Fragment>
-        Create test index pattern
-      </React.Fragment>
-    }
-  >
-    <header
-      className="euiPageHeader euiPageHeader--bottomBorder euiPageHeader--responsive euiPageHeader--center"
-    >
-      <EuiPageHeaderContent
-        pageTitle={
-          <React.Fragment>
-            Create test index pattern
-          </React.Fragment>
-        }
-        responsive={true}
-      >
-        <div
-          className="euiPageHeaderContent"
-        >
-          <EuiFlexGroup
-            alignItems="flexStart"
-            className="euiPageHeaderContent__top"
-            gutterSize="l"
-            responsive={true}
-          >
-            <div
-              className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--alignItemsFlexStart euiFlexGroup--directionRow euiFlexGroup--responsive euiPageHeaderContent__top"
-            >
-              <EuiFlexItem>
-                <div
-                  className="euiFlexItem"
-                >
-                  <EuiTitle
-                    size="l"
-                  >
-                    <h1
-                      className="euiTitle euiTitle--large"
-                    >
-                      Create test index pattern
-                    </h1>
-                  </EuiTitle>
-                </div>
-              </EuiFlexItem>
-            </div>
-          </EuiFlexGroup>
-          <div
-            className="euiPageHeaderContent__bottom"
-          >
-            <EuiSpacer>
-              <div
-                className="euiSpacer euiSpacer--l"
-              />
-            </EuiSpacer>
-            <EuiText>
-              <div
-                className="euiText euiText--medium"
-              >
-                <p>
-                  <FormattedMessage
-                    defaultMessage="An index pattern can match a single source, for example, {single}, or {multiple} data sources, {star}."
-                    id="indexPatternManagement.createIndexPattern.description"
-                    values={
-                      Object {
-                        "multiple": <strong>
-                          multiple
-                        </strong>,
-                        "single": <EuiCode>
-                          filebeat-4-3-22
-                        </EuiCode>,
-                        "star": <EuiCode>
-                          filebeat-*
-                        </EuiCode>,
-                      }
-                    }
-                  >
-                    <span>
-                      An index pattern can match a single source, for example, 
-                      <EuiCode>
-                        <EuiCodeBlockImpl
-                          inline={true}
-                        >
-                          <span>
-                            <code>
-                              filebeat-4-3-22
-                            </code>
-                          </span>
-                        </EuiCodeBlockImpl>
-                      </EuiCode>
-                      , or 
-                      <strong>
-                        multiple
-                      </strong>
-                       data sources, 
-                      <EuiCode>
-                        <EuiCodeBlockImpl
-                          inline={true}
-                        >
-                          <span>
-                            <code>
-                              filebeat-*
-                            </code>
-                          </span>
-                        </EuiCodeBlockImpl>
-                      </EuiCode>
-                      .
-                    </span>
-                  </FormattedMessage>
-                  <br />
-                  <EuiLink
-                    external={true}
-                    target="_blank"
-                  >
-                    <button
-                      className="euiLink euiLink--primary"
-                      disabled={false}
-                      type="button"
-                    >
-                      <FormattedMessage
-                        defaultMessage="Read documentation"
-                        id="indexPatternManagement.createIndexPattern.documentation"
-                        values={Object {}}
-                      >
-                        <span>
-                          Read documentation
-                        </span>
-                      </FormattedMessage>
-                    </button>
-                  </EuiLink>
-                </p>
-              </div>
-            </EuiText>
-          </div>
-        </div>
-      </EuiPageHeaderContent>
-    </header>
-  </EuiPageHeader>
-</Header>
-`;
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/header/header.test.tsx b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/header/header.test.tsx
deleted file mode 100644
index 188fe2fbc02afc..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/header/header.test.tsx
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-import { Header } from '../header';
-import { mount } from 'enzyme';
-import { KibanaContextProvider } from 'src/plugins/kibana_react/public';
-import { mockManagementPlugin } from '../../../../mocks';
-import { DocLinksStart } from 'kibana/public';
-
-describe('Header', () => {
-  const indexPatternName = 'test index pattern';
-  const mockedContext = mockManagementPlugin.createIndexPatternManagmentContext();
-  const mockedDocLinks = {
-    links: {
-      indexPatterns: {},
-    },
-  } as DocLinksStart;
-
-  it('should render normally', () => {
-    const component = mount(
-      <Header indexPatternName={indexPatternName} docLinks={mockedDocLinks} />,
-      {
-        wrappingComponent: KibanaContextProvider,
-        wrappingComponentProps: {
-          services: mockedContext,
-        },
-      }
-    );
-
-    expect(component).toMatchSnapshot();
-  });
-
-  it('should render without including system indices', () => {
-    const component = mount(
-      <Header indexPatternName={indexPatternName} docLinks={mockedDocLinks} />,
-      {
-        wrappingComponent: KibanaContextProvider,
-        wrappingComponentProps: {
-          services: mockedContext,
-        },
-      }
-    );
-
-    expect(component).toMatchSnapshot();
-  });
-
-  it('should render a different name, prompt, and beta tag if provided', () => {
-    const component = mount(
-      <Header
-        prompt={<div>Test prompt</div>}
-        indexPatternName={indexPatternName}
-        isBeta={true}
-        docLinks={mockedDocLinks}
-      />,
-      {
-        wrappingComponent: KibanaContextProvider,
-        wrappingComponentProps: {
-          services: mockedContext,
-        },
-      }
-    );
-
-    expect(component).toMatchSnapshot();
-  });
-});
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/header/header.tsx b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/header/header.tsx
deleted file mode 100644
index c708bd3cac33e7..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/header/header.tsx
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-
-import { EuiBetaBadge, EuiCode, EuiLink, EuiPageHeader, EuiSpacer, EuiText } from '@elastic/eui';
-
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
-import { DocLinksStart } from 'kibana/public';
-import { useKibana } from '../../../../../../../plugins/kibana_react/public';
-import { IndexPatternManagmentContext } from '../../../../types';
-
-export const Header = ({
-  prompt,
-  indexPatternName,
-  isBeta = false,
-  docLinks,
-}: {
-  prompt?: React.ReactNode;
-  indexPatternName: string;
-  isBeta?: boolean;
-  docLinks: DocLinksStart;
-}) => {
-  const changeTitle = useKibana<IndexPatternManagmentContext>().services.chrome.docTitle.change;
-  const createIndexPatternHeader = i18n.translate(
-    'indexPatternManagement.createIndexPatternHeader',
-    {
-      defaultMessage: 'Create {indexPatternName}',
-      values: { indexPatternName },
-    }
-  );
-
-  changeTitle(createIndexPatternHeader);
-
-  return (
-    <EuiPageHeader
-      pageTitle={
-        <>
-          {createIndexPatternHeader}
-          {isBeta ? (
-            <>
-              {' '}
-              <EuiBetaBadge
-                label={i18n.translate('indexPatternManagement.createIndexPattern.betaLabel', {
-                  defaultMessage: 'Beta',
-                })}
-              />
-            </>
-          ) : null}
-        </>
-      }
-      bottomBorder
-    >
-      <EuiText>
-        <p>
-          <FormattedMessage
-            id="indexPatternManagement.createIndexPattern.description"
-            defaultMessage="An index pattern can match a single source, for example, {single}, or {multiple} data sources, {star}."
-            values={{
-              multiple: <strong>multiple</strong>,
-              single: <EuiCode>filebeat-4-3-22</EuiCode>,
-              star: <EuiCode>filebeat-*</EuiCode>,
-            }}
-          />
-          <br />
-          <EuiLink href={docLinks.links.indexPatterns.introduction} target="_blank" external>
-            <FormattedMessage
-              id="indexPatternManagement.createIndexPattern.documentation"
-              defaultMessage="Read documentation"
-            />
-          </EuiLink>
-        </p>
-      </EuiText>
-      {prompt ? (
-        <>
-          <EuiSpacer size="m" />
-          {prompt}
-        </>
-      ) : null}
-    </EuiPageHeader>
-  );
-};
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/loading_state/__snapshots__/loading_state.test.tsx.snap b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/loading_state/__snapshots__/loading_state.test.tsx.snap
deleted file mode 100644
index 1e6ac56d437e1f..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/loading_state/__snapshots__/loading_state.test.tsx.snap
+++ /dev/null
@@ -1,39 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`LoadingState should render normally 1`] = `
-<EuiFlexGroup
-  alignItems="center"
-  direction="column"
-  gutterSize="s"
-  justifyContent="center"
->
-  <EuiFlexItem
-    grow={false}
-  >
-    <EuiTitle
-      size="s"
-    >
-      <h2
-        style={
-          Object {
-            "textAlign": "center",
-          }
-        }
-      >
-        <FormattedMessage
-          defaultMessage="Checking for Elasticsearch data"
-          id="indexPatternManagement.createIndexPattern.loadingState.checkingLabel"
-          values={Object {}}
-        />
-      </h2>
-    </EuiTitle>
-  </EuiFlexItem>
-  <EuiFlexItem
-    grow={false}
-  >
-    <EuiLoadingSpinner
-      size="l"
-    />
-  </EuiFlexItem>
-</EuiFlexGroup>
-`;
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/loading_state/loading_state.tsx b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/loading_state/loading_state.tsx
deleted file mode 100644
index 9cfb9321b3f00e..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/loading_state/loading_state.tsx
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-
-import { EuiFlexGroup, EuiFlexItem, EuiLoadingSpinner, EuiTitle } from '@elastic/eui';
-
-import { FormattedMessage } from '@kbn/i18n/react';
-
-export const LoadingState = () => (
-  <EuiFlexGroup justifyContent="center" alignItems="center" direction="column" gutterSize="s">
-    <EuiFlexItem grow={false}>
-      <EuiTitle size="s">
-        <h2 style={{ textAlign: 'center' }}>
-          <FormattedMessage
-            id="indexPatternManagement.createIndexPattern.loadingState.checkingLabel"
-            defaultMessage="Checking for Elasticsearch data"
-          />
-        </h2>
-      </EuiTitle>
-    </EuiFlexItem>
-
-    <EuiFlexItem grow={false}>
-      <EuiLoadingSpinner size="l" />
-    </EuiFlexItem>
-  </EuiFlexGroup>
-);
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/__snapshots__/step_index_pattern.test.tsx.snap b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/__snapshots__/step_index_pattern.test.tsx.snap
deleted file mode 100644
index 813a0c61c08294..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/__snapshots__/step_index_pattern.test.tsx.snap
+++ /dev/null
@@ -1,58 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`StepIndexPattern renders errors when input is invalid 1`] = `
-Object {
-  "component": <Header
-    characterList="\\\\, /, ?, \\", <, >, |"
-    data-test-subj="createIndexPatternStep1Header"
-    errors={
-      Array [
-        "A name cannot contain spaces or the characters: \\\\, /, ?, \\", <, >, |",
-      ]
-    }
-    goToNextStep={[Function]}
-    isIncludingSystemIndices={false}
-    isInputInvalid={true}
-    isNextStepDisabled={true}
-    onChangeIncludingSystemIndices={[Function]}
-    onQueryChanged={[Function]}
-    query="?"
-  />,
-}
-`;
-
-exports[`StepIndexPattern renders indices which match the initial query 1`] = `
-<IndicesList
-  data-test-subj="createIndexPatternStep1IndicesList"
-  indices={
-    Array [
-      Object {
-        "item": Object {},
-        "name": "kibana",
-      },
-    ]
-  }
-  query="kibana"
-/>
-`;
-
-exports[`StepIndexPattern renders matching indices when input is valid 1`] = `
-<IndicesList
-  data-test-subj="createIndexPatternStep1IndicesList"
-  indices={
-    Array [
-      Object {
-        "item": Object {},
-        "name": "kibana",
-      },
-    ]
-  }
-  query="k*"
-/>
-`;
-
-exports[`StepIndexPattern renders the loading state 1`] = `
-<LoadingIndices
-  data-test-subj="createIndexPatternStep1Loading"
-/>
-`;
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/header/__snapshots__/header.test.tsx.snap b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/header/__snapshots__/header.test.tsx.snap
deleted file mode 100644
index 851e5cc4c2a762..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/header/__snapshots__/header.test.tsx.snap
+++ /dev/null
@@ -1,221 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`Header should mark the input as invalid 1`] = `
-<div>
-  <EuiTitle
-    size="s"
-  >
-    <h2>
-      <FormattedMessage
-        defaultMessage="Step 1 of 2: Define an index pattern"
-        id="indexPatternManagement.createIndexPattern.stepHeader"
-        values={Object {}}
-      />
-    </h2>
-  </EuiTitle>
-  <EuiSpacer
-    size="m"
-  />
-  <EuiFlexGroup>
-    <EuiFlexItem>
-      <EuiForm
-        isInvalid={true}
-      >
-        <EuiFormRow
-          describedByIds={Array []}
-          display="row"
-          error={
-            Array [
-              "Input is invalid",
-            ]
-          }
-          fullWidth={true}
-          hasChildLabel={true}
-          hasEmptyLabelSpace={false}
-          helpText={
-            <React.Fragment>
-              <FormattedMessage
-                defaultMessage="Use an asterisk ({asterisk}) to match multiple indices."
-                id="indexPatternManagement.createIndexPattern.step.indexPattern.allowLabel"
-                values={
-                  Object {
-                    "asterisk": <strong>
-                      *
-                    </strong>,
-                  }
-                }
-              />
-               
-              <FormattedMessage
-                defaultMessage="Spaces and the characters {characterList} are not allowed."
-                id="indexPatternManagement.createIndexPattern.step.indexPattern.disallowLabel"
-                values={
-                  Object {
-                    "characterList": <strong>
-                      %
-                    </strong>,
-                  }
-                }
-              />
-            </React.Fragment>
-          }
-          isInvalid={true}
-          label={
-            <FormattedMessage
-              defaultMessage="Index pattern name"
-              id="indexPatternManagement.createIndexPattern.step.indexPatternLabel"
-              values={Object {}}
-            />
-          }
-          labelType="label"
-        >
-          <EuiFieldText
-            data-test-subj="createIndexPatternNameInput"
-            fullWidth={true}
-            isInvalid={true}
-            name="indexPattern"
-            onChange={[Function]}
-            placeholder="index-name-*"
-            value="%"
-          />
-        </EuiFormRow>
-      </EuiForm>
-    </EuiFlexItem>
-    <EuiFlexItem
-      grow={false}
-    >
-      <EuiFormRow
-        describedByIds={Array []}
-        display="row"
-        fullWidth={false}
-        hasChildLabel={true}
-        hasEmptyLabelSpace={true}
-        labelType="label"
-      >
-        <EuiButton
-          data-test-subj="createIndexPatternGoToStep2Button"
-          fill={true}
-          iconSide="right"
-          iconType="arrowRight"
-          isDisabled={true}
-          onClick={[Function]}
-        >
-          <FormattedMessage
-            defaultMessage="Next step"
-            id="indexPatternManagement.createIndexPattern.step.nextStepButton"
-            values={Object {}}
-          />
-        </EuiButton>
-      </EuiFormRow>
-    </EuiFlexItem>
-  </EuiFlexGroup>
-</div>
-`;
-
-exports[`Header should render normally 1`] = `
-<div>
-  <EuiTitle
-    size="s"
-  >
-    <h2>
-      <FormattedMessage
-        defaultMessage="Step 1 of 2: Define an index pattern"
-        id="indexPatternManagement.createIndexPattern.stepHeader"
-        values={Object {}}
-      />
-    </h2>
-  </EuiTitle>
-  <EuiSpacer
-    size="m"
-  />
-  <EuiFlexGroup>
-    <EuiFlexItem>
-      <EuiForm
-        isInvalid={false}
-      >
-        <EuiFormRow
-          describedByIds={Array []}
-          display="row"
-          error={Array []}
-          fullWidth={true}
-          hasChildLabel={true}
-          hasEmptyLabelSpace={false}
-          helpText={
-            <React.Fragment>
-              <FormattedMessage
-                defaultMessage="Use an asterisk ({asterisk}) to match multiple indices."
-                id="indexPatternManagement.createIndexPattern.step.indexPattern.allowLabel"
-                values={
-                  Object {
-                    "asterisk": <strong>
-                      *
-                    </strong>,
-                  }
-                }
-              />
-               
-              <FormattedMessage
-                defaultMessage="Spaces and the characters {characterList} are not allowed."
-                id="indexPatternManagement.createIndexPattern.step.indexPattern.disallowLabel"
-                values={
-                  Object {
-                    "characterList": <strong>
-                      %
-                    </strong>,
-                  }
-                }
-              />
-            </React.Fragment>
-          }
-          isInvalid={false}
-          label={
-            <FormattedMessage
-              defaultMessage="Index pattern name"
-              id="indexPatternManagement.createIndexPattern.step.indexPatternLabel"
-              values={Object {}}
-            />
-          }
-          labelType="label"
-        >
-          <EuiFieldText
-            data-test-subj="createIndexPatternNameInput"
-            fullWidth={true}
-            isInvalid={false}
-            name="indexPattern"
-            onChange={[Function]}
-            placeholder="index-name-*"
-            value="k"
-          />
-        </EuiFormRow>
-      </EuiForm>
-    </EuiFlexItem>
-    <EuiFlexItem
-      grow={false}
-    >
-      <EuiFormRow
-        describedByIds={Array []}
-        display="row"
-        fullWidth={false}
-        hasChildLabel={true}
-        hasEmptyLabelSpace={true}
-        labelType="label"
-      >
-        <EuiButton
-          data-test-subj="createIndexPatternGoToStep2Button"
-          fill={true}
-          iconSide="right"
-          iconType="arrowRight"
-          isDisabled={false}
-          onClick={[Function]}
-        >
-          <FormattedMessage
-            defaultMessage="Next step"
-            id="indexPatternManagement.createIndexPattern.step.nextStepButton"
-            values={Object {}}
-          />
-        </EuiButton>
-      </EuiFormRow>
-    </EuiFlexItem>
-  </EuiFlexGroup>
-</div>
-`;
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/header/header.test.tsx b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/header/header.test.tsx
deleted file mode 100644
index 8c7e43ed57c778..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/header/header.test.tsx
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-import { Header } from '../header';
-import { shallowWithI18nProvider } from '@kbn/test/jest';
-
-describe('Header', () => {
-  it('should render normally', () => {
-    const component = shallowWithI18nProvider(
-      <Header
-        isInputInvalid={false}
-        errors={[]}
-        characterList={'%'}
-        query={'k'}
-        onQueryChanged={() => {}}
-        goToNextStep={() => {}}
-        isNextStepDisabled={false}
-        onChangeIncludingSystemIndices={() => {}}
-        isIncludingSystemIndices={false}
-      />
-    );
-
-    expect(component).toMatchSnapshot();
-  });
-
-  it('should mark the input as invalid', () => {
-    const component = shallowWithI18nProvider(
-      <Header
-        isInputInvalid={true}
-        errors={['Input is invalid']}
-        characterList={'%'}
-        query={'%'}
-        onQueryChanged={() => {}}
-        goToNextStep={() => {}}
-        isNextStepDisabled={true}
-        onChangeIncludingSystemIndices={() => {}}
-        isIncludingSystemIndices={false}
-      />
-    );
-
-    expect(component).toMatchSnapshot();
-  });
-});
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/header/header.tsx b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/header/header.tsx
deleted file mode 100644
index 342665b185e795..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/components/header/header.tsx
+++ /dev/null
@@ -1,144 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-
-import {
-  EuiTitle,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiSpacer,
-  EuiButton,
-  EuiForm,
-  EuiFormRow,
-  EuiFieldText,
-  EuiSwitchEvent,
-  EuiSwitch,
-} from '@elastic/eui';
-
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
-
-interface HeaderProps {
-  isInputInvalid: boolean;
-  errors: any;
-  characterList: string;
-  query: string;
-  onQueryChanged: (e: React.ChangeEvent<HTMLInputElement>) => void;
-  goToNextStep: (query: string) => void;
-  isNextStepDisabled: boolean;
-  showSystemIndices?: boolean;
-  onChangeIncludingSystemIndices: (event: EuiSwitchEvent) => void;
-  isIncludingSystemIndices: boolean;
-}
-
-export const Header: React.FC<HeaderProps> = ({
-  isInputInvalid,
-  errors,
-  characterList,
-  query,
-  onQueryChanged,
-  goToNextStep,
-  isNextStepDisabled,
-  showSystemIndices = false,
-  onChangeIncludingSystemIndices,
-  isIncludingSystemIndices,
-  ...rest
-}) => (
-  <div {...rest}>
-    <EuiTitle size="s">
-      <h2>
-        <FormattedMessage
-          id="indexPatternManagement.createIndexPattern.stepHeader"
-          defaultMessage="Step 1 of 2: Define an index pattern"
-        />
-      </h2>
-    </EuiTitle>
-    <EuiSpacer size="m" />
-    <EuiFlexGroup>
-      <EuiFlexItem>
-        <EuiForm isInvalid={isInputInvalid}>
-          <EuiFormRow
-            fullWidth
-            label={
-              <FormattedMessage
-                id="indexPatternManagement.createIndexPattern.step.indexPatternLabel"
-                defaultMessage="Index pattern name"
-              />
-            }
-            isInvalid={isInputInvalid}
-            error={errors}
-            helpText={
-              <>
-                <FormattedMessage
-                  id="indexPatternManagement.createIndexPattern.step.indexPattern.allowLabel"
-                  defaultMessage="Use an asterisk ({asterisk}) to match multiple indices."
-                  values={{ asterisk: <strong>*</strong> }}
-                />{' '}
-                <FormattedMessage
-                  id="indexPatternManagement.createIndexPattern.step.indexPattern.disallowLabel"
-                  defaultMessage="Spaces and the characters {characterList} are not allowed."
-                  values={{ characterList: <strong>{characterList}</strong> }}
-                />
-              </>
-            }
-          >
-            <EuiFieldText
-              name="indexPattern"
-              placeholder={i18n.translate(
-                'indexPatternManagement.createIndexPattern.step.indexPatternPlaceholder',
-                {
-                  defaultMessage: 'index-name-*',
-                }
-              )}
-              value={query}
-              isInvalid={isInputInvalid}
-              onChange={onQueryChanged}
-              data-test-subj="createIndexPatternNameInput"
-              fullWidth
-            />
-          </EuiFormRow>
-
-          {showSystemIndices ? (
-            <EuiFormRow>
-              <EuiSwitch
-                label={
-                  <FormattedMessage
-                    id="indexPatternManagement.createIndexPattern.includeSystemIndicesToggleSwitchLabel"
-                    defaultMessage="Include system and hidden indices"
-                  />
-                }
-                id="checkboxShowSystemIndices"
-                checked={isIncludingSystemIndices}
-                onChange={onChangeIncludingSystemIndices}
-                data-test-subj="showSystemAndHiddenIndices"
-              />
-            </EuiFormRow>
-          ) : null}
-        </EuiForm>
-      </EuiFlexItem>
-      <EuiFlexItem grow={false}>
-        <EuiFormRow hasEmptyLabelSpace>
-          <EuiButton
-            fill
-            iconSide="right"
-            iconType="arrowRight"
-            onClick={() => goToNextStep(query)}
-            isDisabled={isNextStepDisabled}
-            data-test-subj="createIndexPatternGoToStep2Button"
-          >
-            <FormattedMessage
-              id="indexPatternManagement.createIndexPattern.step.nextStepButton"
-              defaultMessage="Next step"
-            />
-          </EuiButton>
-        </EuiFormRow>
-      </EuiFlexItem>
-    </EuiFlexGroup>
-  </div>
-);
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/index.ts b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/index.ts
deleted file mode 100644
index 3d87a6d7c39dc8..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/index.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-export { StepIndexPattern } from './step_index_pattern';
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/step_index_pattern.test.tsx b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/step_index_pattern.test.tsx
deleted file mode 100644
index 8b4f751a4e3a3d..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/step_index_pattern.test.tsx
+++ /dev/null
@@ -1,244 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-import { StepIndexPattern, canPreselectTimeField } from './step_index_pattern';
-import { Header } from './components/header';
-import { IndexPatternCreationConfig } from '../../../../../../../plugins/index_pattern_management/public';
-import { mockManagementPlugin } from '../../../../mocks';
-import { createComponentWithContext } from '../../../test_utils';
-
-jest.mock('../../lib/ensure_minimum_time', () => ({
-  ensureMinimumTime: async (promises: Array<Promise<any>>) =>
-    Array.isArray(promises) ? await Promise.all(promises) : await promises,
-}));
-
-const mockIndexPatternCreationType = new IndexPatternCreationConfig({
-  type: 'default',
-  name: 'name',
-});
-
-jest.mock('../../lib/get_indices', () => ({
-  getIndices: ({}, {}, query: string) => {
-    if (query.startsWith('e')) {
-      return [{ name: 'es', item: {} }];
-    }
-
-    return [{ name: 'kibana', item: {} }];
-  },
-}));
-
-const allIndices = [
-  { name: 'kibana', tags: [], item: {} },
-  { name: 'es', tags: [], item: {} },
-];
-
-const goToNextStep = () => {};
-
-const mockContext = mockManagementPlugin.createIndexPatternManagmentContext();
-
-mockContext.data.indexPatterns.getTitles = async () => Promise.resolve([]);
-mockContext.uiSettings.get.mockReturnValue('');
-
-describe('StepIndexPattern', () => {
-  it('renders the loading state', () => {
-    const component = createComponentWithContext(
-      StepIndexPattern,
-      {
-        allIndices,
-        isIncludingSystemIndices: false,
-        goToNextStep,
-        indexPatternCreationType: mockIndexPatternCreationType,
-      },
-      mockContext
-    );
-    component.setState({ isLoadingIndices: true });
-    expect(component.find('[data-test-subj="createIndexPatternStep1Loading"]')).toMatchSnapshot();
-  });
-
-  it('renders indices which match the initial query', async () => {
-    const component = createComponentWithContext(
-      StepIndexPattern,
-      {
-        allIndices,
-        isIncludingSystemIndices: false,
-        goToNextStep,
-        indexPatternCreationType: mockIndexPatternCreationType,
-        initialQuery: 'kibana',
-      },
-      mockContext
-    );
-
-    // Ensure all promises resolve
-    await new Promise((resolve) => process.nextTick(resolve));
-    // Ensure the state changes are reflected
-    await component.update();
-
-    expect(
-      component.find('[data-test-subj="createIndexPatternStep1IndicesList"]')
-    ).toMatchSnapshot();
-  });
-
-  it('renders errors when input is invalid', async () => {
-    const component = createComponentWithContext(
-      StepIndexPattern,
-      {
-        allIndices,
-        isIncludingSystemIndices: false,
-        goToNextStep,
-        indexPatternCreationType: mockIndexPatternCreationType,
-      },
-      mockContext
-    );
-    const instance = component.instance() as StepIndexPattern;
-    instance.onQueryChanged({ target: { value: '?' } } as React.ChangeEvent<HTMLInputElement>);
-
-    // Ensure all promises resolve
-    await new Promise((resolve) => process.nextTick(resolve));
-    // Ensure the state changes are reflected
-    component.update();
-    expect({
-      component: component.find('[data-test-subj="createIndexPatternStep1Header"]'),
-    }).toMatchSnapshot();
-  });
-
-  it('renders matching indices when input is valid', async () => {
-    const component = createComponentWithContext(
-      StepIndexPattern,
-      {
-        allIndices,
-        isIncludingSystemIndices: false,
-        goToNextStep,
-        indexPatternCreationType: mockIndexPatternCreationType,
-      },
-      mockContext
-    );
-    const instance = component.instance() as StepIndexPattern;
-    instance.onQueryChanged({ target: { value: 'k' } } as React.ChangeEvent<HTMLInputElement>);
-
-    // Ensure all promises resolve
-    await new Promise((resolve) => process.nextTick(resolve));
-    // Ensure the state changes are reflected
-    component.update();
-
-    expect(
-      component.find('[data-test-subj="createIndexPatternStep1IndicesList"]')
-    ).toMatchSnapshot();
-  });
-
-  it('appends a wildcard automatically to queries', async () => {
-    const component = createComponentWithContext(
-      StepIndexPattern,
-      {
-        allIndices,
-        isIncludingSystemIndices: false,
-        goToNextStep,
-        indexPatternCreationType: mockIndexPatternCreationType,
-      },
-      mockContext
-    );
-    const instance = component.instance() as StepIndexPattern;
-    instance.onQueryChanged({ target: { value: 'k' } } as React.ChangeEvent<HTMLInputElement>);
-    expect(component.state('query')).toBe('k*');
-  });
-
-  it('disables the next step if the index pattern exists', async () => {
-    const component = createComponentWithContext(
-      StepIndexPattern,
-      {
-        allIndices,
-        isIncludingSystemIndices: false,
-        goToNextStep,
-        indexPatternCreationType: mockIndexPatternCreationType,
-      },
-      mockContext
-    );
-    component.setState({ indexPatternExists: true });
-    expect(component.find(Header).prop('isNextStepDisabled')).toBe(true);
-  });
-
-  it('ensures the response of the latest request is persisted', async () => {
-    const component = createComponentWithContext(
-      StepIndexPattern,
-      {
-        allIndices,
-        isIncludingSystemIndices: false,
-        goToNextStep,
-        indexPatternCreationType: mockIndexPatternCreationType,
-      },
-      mockContext
-    );
-    const instance = component.instance() as StepIndexPattern;
-    instance.onQueryChanged({ target: { value: 'e' } } as React.ChangeEvent<HTMLInputElement>);
-    instance.lastQuery = 'k';
-    await new Promise((resolve) => process.nextTick(resolve));
-
-    // Honesty, the state would match the result of the `k` query but
-    // it's hard to mock this in tests but if remove our fix
-    // (the early return if the queries do not match) then this
-    // equals [{name: 'es'}]
-    expect(component.state('exactMatchedIndices')).toEqual([]);
-
-    // Ensure it works in the other code flow too (the other early return)
-
-    // Provide `es` so we do not auto append * and enter our other code flow
-    instance.onQueryChanged({ target: { value: 'es' } } as React.ChangeEvent<HTMLInputElement>);
-    instance.lastQuery = 'k';
-    await new Promise((resolve) => process.nextTick(resolve));
-    expect(component.state('exactMatchedIndices')).toEqual([]);
-  });
-
-  it('it can preselect time field', async () => {
-    const dataStream1 = {
-      name: 'data stream 1',
-      tags: [],
-      item: { name: 'data stream 1', backing_indices: [], timestamp_field: 'timestamp_field' },
-    };
-
-    const dataStream2 = {
-      name: 'data stream 2',
-      tags: [],
-      item: { name: 'data stream 2', backing_indices: [], timestamp_field: 'timestamp_field' },
-    };
-
-    const differentDataStream = {
-      name: 'different data stream',
-      tags: [],
-      item: { name: 'different data stream 2', backing_indices: [], timestamp_field: 'x' },
-    };
-
-    const index = {
-      name: 'index',
-      tags: [],
-      item: {
-        name: 'index',
-      },
-    };
-
-    const alias = {
-      name: 'alias',
-      tags: [],
-      item: {
-        name: 'alias',
-        indices: [],
-      },
-    };
-
-    expect(canPreselectTimeField([index])).toEqual(undefined);
-    expect(canPreselectTimeField([alias])).toEqual(undefined);
-    expect(canPreselectTimeField([index, alias, dataStream1])).toEqual(undefined);
-
-    expect(canPreselectTimeField([dataStream1])).toEqual('timestamp_field');
-
-    expect(canPreselectTimeField([dataStream1, dataStream2])).toEqual('timestamp_field');
-
-    expect(canPreselectTimeField([dataStream1, dataStream2, differentDataStream])).toEqual(
-      undefined
-    );
-  });
-});
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/step_index_pattern.tsx b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/step_index_pattern.tsx
deleted file mode 100644
index 052e454041181e..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_index_pattern/step_index_pattern.tsx
+++ /dev/null
@@ -1,367 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React, { Component } from 'react';
-import { EuiSpacer, EuiCallOut, EuiSwitchEvent } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
-import { indexPatterns, UI_SETTINGS } from '../../../../../../../plugins/data/public';
-import {
-  getIndices,
-  containsIllegalCharacters,
-  getMatchedIndices,
-  canAppendWildcard,
-  ensureMinimumTime,
-} from '../../lib';
-import { LoadingIndices } from './components/loading_indices';
-import { StatusMessage } from './components/status_message';
-import { IndicesList } from './components/indices_list';
-import { Header } from './components/header';
-import { context as contextType } from '../../../../../../kibana_react/public';
-import { IndexPatternCreationConfig } from '../../../../../../../plugins/index_pattern_management/public';
-import { MatchedItem } from '../../types';
-import { IndexPatternManagmentContextValue } from '../../../../types';
-
-interface StepIndexPatternProps {
-  allIndices: MatchedItem[];
-  indexPatternCreationType: IndexPatternCreationConfig;
-  goToNextStep: (query: string, timestampField?: string) => void;
-  initialQuery?: string;
-  showSystemIndices: boolean;
-}
-
-interface StepIndexPatternState {
-  partialMatchedIndices: MatchedItem[];
-  exactMatchedIndices: MatchedItem[];
-  isLoadingIndices: boolean;
-  existingIndexPatterns: string[];
-  indexPatternExists: boolean;
-  query: string;
-  appendedWildcard: boolean;
-  showingIndexPatternQueryErrors: boolean;
-  indexPatternName: string;
-  isIncludingSystemIndices: boolean;
-}
-
-export const canPreselectTimeField = (indices: MatchedItem[]) => {
-  const preselectStatus = indices.reduce(
-    (
-      { canPreselect, timeFieldName }: { canPreselect: boolean; timeFieldName?: string },
-      matchedItem
-    ) => {
-      const dataStreamItem = matchedItem.item;
-      const dataStreamTimestampField = dataStreamItem.timestamp_field;
-      const isDataStream = !!dataStreamItem.timestamp_field;
-      const timestampFieldMatches =
-        timeFieldName === undefined || timeFieldName === dataStreamTimestampField;
-
-      return {
-        canPreselect: canPreselect && isDataStream && timestampFieldMatches,
-        timeFieldName: dataStreamTimestampField || timeFieldName,
-      };
-    },
-    {
-      canPreselect: true,
-      timeFieldName: undefined,
-    }
-  );
-
-  return preselectStatus.canPreselect ? preselectStatus.timeFieldName : undefined;
-};
-
-export class StepIndexPattern extends Component<StepIndexPatternProps, StepIndexPatternState> {
-  static contextType = contextType;
-
-  public readonly context!: IndexPatternManagmentContextValue;
-
-  state = {
-    partialMatchedIndices: [],
-    exactMatchedIndices: [],
-    isLoadingIndices: false,
-    existingIndexPatterns: [],
-    indexPatternExists: false,
-    query: '',
-    appendedWildcard: false,
-    showingIndexPatternQueryErrors: false,
-    indexPatternName: '',
-    isIncludingSystemIndices: false,
-  };
-
-  ILLEGAL_CHARACTERS = [...indexPatterns.ILLEGAL_CHARACTERS];
-
-  constructor(props: StepIndexPatternProps, context: IndexPatternManagmentContextValue) {
-    super(props, context);
-    const { indexPatternCreationType, initialQuery } = this.props;
-
-    this.state.query =
-      initialQuery || context.services.uiSettings.get(UI_SETTINGS.INDEXPATTERN_PLACEHOLDER);
-    this.state.indexPatternName = indexPatternCreationType.getIndexPatternName();
-  }
-
-  lastQuery = '';
-
-  async UNSAFE_componentWillMount() {
-    this.fetchExistingIndexPatterns();
-    if (this.state.query) {
-      this.lastQuery = this.state.query;
-      this.fetchIndices(this.state.query);
-    }
-  }
-
-  fetchExistingIndexPatterns = async () => {
-    const existingIndexPatterns = await this.context.services.data.indexPatterns.getTitles();
-    this.setState({ existingIndexPatterns });
-  };
-
-  fetchIndices = async (query: string) => {
-    const { indexPatternCreationType } = this.props;
-    const { existingIndexPatterns } = this.state;
-
-    if ((existingIndexPatterns as string[]).includes(query)) {
-      this.setState({ indexPatternExists: true });
-      return;
-    }
-
-    this.setState({ isLoadingIndices: true, indexPatternExists: false });
-
-    if (query.endsWith('*')) {
-      const exactMatchedIndices = await ensureMinimumTime(
-        getIndices(
-          this.context.services.http,
-          (indexName: string) => indexPatternCreationType.getIndexTags(indexName),
-          query,
-          this.state.isIncludingSystemIndices
-        )
-      );
-      // If the search changed, discard this state
-      if (query !== this.lastQuery) {
-        return;
-      }
-      this.setState({ exactMatchedIndices, isLoadingIndices: false });
-      return;
-    }
-
-    const [partialMatchedIndices, exactMatchedIndices] = await ensureMinimumTime([
-      getIndices(
-        this.context.services.http,
-        (indexName: string) => indexPatternCreationType.getIndexTags(indexName),
-        `${query}*`,
-        this.state.isIncludingSystemIndices
-      ),
-      getIndices(
-        this.context.services.http,
-        (indexName: string) => indexPatternCreationType.getIndexTags(indexName),
-        query,
-        this.state.isIncludingSystemIndices
-      ),
-    ]);
-
-    // If the search changed, discard this state
-    if (query !== this.lastQuery) {
-      return;
-    }
-
-    this.setState({
-      partialMatchedIndices,
-      exactMatchedIndices,
-      isLoadingIndices: false,
-    });
-  };
-
-  onQueryChanged = (e: React.ChangeEvent<HTMLInputElement>) => {
-    const { appendedWildcard } = this.state;
-    const { target } = e;
-
-    let query = target.value;
-    if (query.length === 1 && !appendedWildcard && canAppendWildcard(query)) {
-      query += '*';
-      this.setState({ appendedWildcard: true });
-      setTimeout(() => target.setSelectionRange(1, 1));
-    } else {
-      if (['', '*'].includes(query) && appendedWildcard) {
-        query = '';
-        this.setState({ appendedWildcard: false });
-      }
-    }
-
-    this.lastQuery = query;
-    this.setState({ query, showingIndexPatternQueryErrors: !!query.length });
-    this.fetchIndices(query);
-  };
-
-  renderLoadingState() {
-    const { isLoadingIndices } = this.state;
-
-    if (!isLoadingIndices) {
-      return null;
-    }
-
-    return (
-      <>
-        <EuiSpacer />
-        <LoadingIndices data-test-subj="createIndexPatternStep1Loading" />
-        <EuiSpacer />
-      </>
-    );
-  }
-
-  renderStatusMessage(matchedIndices: {
-    allIndices: MatchedItem[];
-    exactMatchedIndices: MatchedItem[];
-    partialMatchedIndices: MatchedItem[];
-  }) {
-    const { indexPatternCreationType } = this.props;
-    const { query, isLoadingIndices, indexPatternExists, isIncludingSystemIndices } = this.state;
-
-    if (isLoadingIndices || indexPatternExists) {
-      return null;
-    }
-
-    return (
-      <StatusMessage
-        matchedIndices={matchedIndices}
-        showSystemIndices={indexPatternCreationType.getShowSystemIndices()}
-        isIncludingSystemIndices={isIncludingSystemIndices}
-        query={query}
-      />
-    );
-  }
-
-  renderList({
-    visibleIndices,
-    allIndices,
-  }: {
-    visibleIndices: MatchedItem[];
-    allIndices: MatchedItem[];
-  }) {
-    const { query, isLoadingIndices, indexPatternExists } = this.state;
-
-    if (isLoadingIndices || indexPatternExists) {
-      return null;
-    }
-
-    const indicesToList = query.length ? visibleIndices : allIndices;
-    return (
-      <IndicesList
-        data-test-subj="createIndexPatternStep1IndicesList"
-        query={query}
-        indices={indicesToList}
-      />
-    );
-  }
-
-  renderIndexPatternExists() {
-    const { indexPatternExists, query } = this.state;
-
-    if (!indexPatternExists) {
-      return null;
-    }
-
-    return (
-      <EuiCallOut
-        title={
-          <FormattedMessage
-            id="indexPatternManagement.createIndexPattern.step.warningHeader"
-            defaultMessage="There's already an index pattern called {query}"
-            values={{ query }}
-          />
-        }
-        iconType="help"
-        color="warning"
-      />
-    );
-  }
-
-  renderHeader({ exactMatchedIndices: indices }: { exactMatchedIndices: MatchedItem[] }) {
-    const { goToNextStep, indexPatternCreationType } = this.props;
-    const {
-      query,
-      showingIndexPatternQueryErrors,
-      indexPatternExists,
-      indexPatternName,
-      isIncludingSystemIndices,
-    } = this.state;
-
-    let containsErrors = false;
-    const errors = [];
-    const characterList = this.ILLEGAL_CHARACTERS.slice(0, this.ILLEGAL_CHARACTERS.length - 1).join(
-      ', '
-    );
-
-    const checkIndices = indexPatternCreationType.checkIndicesForErrors(indices);
-
-    if (!query || !query.length || query === '.' || query === '..') {
-      // This is an error scenario but do not report an error
-      containsErrors = true;
-    } else if (containsIllegalCharacters(query, indexPatterns.ILLEGAL_CHARACTERS)) {
-      const errorMessage = i18n.translate(
-        'indexPatternManagement.createIndexPattern.step.invalidCharactersErrorMessage',
-        {
-          defaultMessage:
-            'A {indexPatternName} cannot contain spaces or the characters: {characterList}',
-          values: { characterList, indexPatternName },
-        }
-      );
-
-      errors.push(errorMessage);
-      containsErrors = true;
-    } else if (checkIndices) {
-      errors.push(...(checkIndices as string[]));
-      containsErrors = true;
-    }
-
-    const isInputInvalid = showingIndexPatternQueryErrors && containsErrors && errors.length > 0;
-    const isNextStepDisabled = containsErrors || indices.length === 0 || indexPatternExists;
-
-    return (
-      <Header
-        data-test-subj="createIndexPatternStep1Header"
-        isInputInvalid={isInputInvalid}
-        errors={errors}
-        characterList={characterList}
-        query={query}
-        onQueryChanged={this.onQueryChanged}
-        goToNextStep={() => goToNextStep(query, canPreselectTimeField(indices))}
-        isNextStepDisabled={isNextStepDisabled}
-        onChangeIncludingSystemIndices={this.onChangeIncludingSystemIndices}
-        isIncludingSystemIndices={isIncludingSystemIndices}
-        showSystemIndices={this.props.showSystemIndices}
-      />
-    );
-  }
-
-  onChangeIncludingSystemIndices = (event: EuiSwitchEvent) => {
-    this.setState({ isIncludingSystemIndices: event.target.checked }, () =>
-      this.fetchIndices(this.state.query)
-    );
-  };
-
-  render() {
-    const { allIndices } = this.props;
-    const { partialMatchedIndices, exactMatchedIndices, isIncludingSystemIndices } = this.state;
-
-    const matchedIndices = getMatchedIndices(
-      allIndices,
-      partialMatchedIndices,
-      exactMatchedIndices,
-      isIncludingSystemIndices
-    );
-
-    return (
-      <>
-        {this.renderHeader(matchedIndices)}
-        <EuiSpacer />
-        {this.renderLoadingState()}
-        {this.renderIndexPatternExists()}
-        {this.renderStatusMessage(matchedIndices)}
-        <EuiSpacer />
-        {this.renderList(matchedIndices)}
-      </>
-    );
-  }
-}
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/__snapshots__/step_time_field.test.tsx.snap b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/__snapshots__/step_time_field.test.tsx.snap
deleted file mode 100644
index 544e3ba9831226..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/__snapshots__/step_time_field.test.tsx.snap
+++ /dev/null
@@ -1,364 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`StepTimeField should disable the action button if an invalid time field is selected 1`] = `
-<ActionButtons
-  createIndexPattern={[Function]}
-  goToPreviousStep={[Function]}
-  submittable={false}
-/>
-`;
-
-exports[`StepTimeField should enable the action button if the user decides to not select a time field 1`] = `
-<ActionButtons
-  createIndexPattern={[Function]}
-  goToPreviousStep={[Function]}
-  submittable={true}
-/>
-`;
-
-exports[`StepTimeField should render "Custom index pattern ID already exists" when error is "Conflict" 1`] = `
-<Fragment>
-  <Header
-    indexPattern="ki*"
-    indexPatternName="name"
-  />
-  <EuiSpacer
-    size="m"
-  />
-  <TimeField
-    fetchTimeFields={[Function]}
-    isLoading={true}
-    isVisible={false}
-    onTimeFieldChanged={[Function]}
-    timeFieldOptions={Array []}
-  />
-  <EuiHorizontalRule />
-  <AdvancedOptions
-    indexPatternId=""
-    isVisible={false}
-    onChangeIndexPatternId={[Function]}
-    toggleAdvancedOptions={[Function]}
-  />
-  <EuiSpacer
-    size="m"
-  />
-  <EuiCallOut
-    color="danger"
-    iconType="cross"
-    title={
-      <FormattedMessage
-        defaultMessage="Error"
-        id="indexPatternManagement.createIndexPattern.stepTime.error"
-        values={Object {}}
-      />
-    }
-  >
-    <p>
-      <FormattedMessage
-        defaultMessage="Custom index pattern ID already exists."
-        id="indexPatternManagement.createIndexPattern.stepTime.patterAlreadyExists"
-        values={Object {}}
-      />
-    </p>
-  </EuiCallOut>
-  <EuiSpacer
-    size="m"
-  />
-  <ActionButtons
-    createIndexPattern={[Function]}
-    goToPreviousStep={[Function]}
-    submittable={true}
-  />
-</Fragment>
-`;
-
-exports[`StepTimeField should render a loading state when creating the index pattern 1`] = `
-<EuiFlexGroup
-  alignItems="center"
-  direction="column"
-  gutterSize="s"
-  justifyContent="center"
->
-  <EuiFlexItem
-    grow={false}
-  >
-    <EuiTitle
-      size="s"
-    >
-      <h3
-        className="eui-textCenter"
-      >
-        <FormattedMessage
-          defaultMessage="Creating index pattern…"
-          id="indexPatternManagement.createIndexPattern.stepTime.creatingLabel"
-          values={Object {}}
-        />
-      </h3>
-    </EuiTitle>
-  </EuiFlexItem>
-  <EuiFlexItem
-    grow={false}
-  >
-    <EuiLoadingSpinner
-      size="l"
-    />
-  </EuiFlexItem>
-</EuiFlexGroup>
-`;
-
-exports[`StepTimeField should render a selected timeField 1`] = `
-<Fragment>
-  <Header
-    indexPattern="ki*"
-    indexPatternName="name"
-  />
-  <EuiSpacer
-    size="m"
-  />
-  <TimeField
-    fetchTimeFields={[Function]}
-    isLoading={true}
-    isVisible={true}
-    onTimeFieldChanged={[Function]}
-    selectedTimeField="@timestamp"
-    timeFieldOptions={
-      Array [
-        Object {
-          "text": "",
-          "value": "",
-        },
-        Object {
-          "disabled": undefined,
-          "text": "@timestamp",
-          "value": "@timestamp",
-        },
-        Object {
-          "disabled": undefined,
-          "text": "name",
-          "value": "name",
-        },
-      ]
-    }
-  />
-  <EuiHorizontalRule />
-  <AdvancedOptions
-    indexPatternId=""
-    isVisible={false}
-    onChangeIndexPatternId={[Function]}
-    toggleAdvancedOptions={[Function]}
-  />
-  <EuiSpacer
-    size="m"
-  />
-  <ActionButtons
-    createIndexPattern={[Function]}
-    goToPreviousStep={[Function]}
-    submittable={true}
-  />
-</Fragment>
-`;
-
-exports[`StepTimeField should render advanced options 1`] = `
-<Fragment>
-  <Header
-    indexPattern="ki*"
-    indexPatternName="name"
-  />
-  <EuiSpacer
-    size="m"
-  />
-  <TimeField
-    fetchTimeFields={[Function]}
-    isLoading={true}
-    isVisible={false}
-    onTimeFieldChanged={[Function]}
-    timeFieldOptions={Array []}
-  />
-  <EuiHorizontalRule />
-  <AdvancedOptions
-    indexPatternId=""
-    isVisible={false}
-    onChangeIndexPatternId={[Function]}
-    toggleAdvancedOptions={[Function]}
-  />
-  <EuiSpacer
-    size="m"
-  />
-  <ActionButtons
-    createIndexPattern={[Function]}
-    goToPreviousStep={[Function]}
-    submittable={true}
-  />
-</Fragment>
-`;
-
-exports[`StepTimeField should render advanced options with an index pattern id 1`] = `
-<Fragment>
-  <Header
-    indexPattern="ki*"
-    indexPatternName="name"
-  />
-  <EuiSpacer
-    size="m"
-  />
-  <TimeField
-    fetchTimeFields={[Function]}
-    isLoading={true}
-    isVisible={false}
-    onTimeFieldChanged={[Function]}
-    timeFieldOptions={Array []}
-  />
-  <EuiHorizontalRule />
-  <AdvancedOptions
-    indexPatternId="foobar"
-    isVisible={false}
-    onChangeIndexPatternId={[Function]}
-    toggleAdvancedOptions={[Function]}
-  />
-  <EuiSpacer
-    size="m"
-  />
-  <ActionButtons
-    createIndexPattern={[Function]}
-    goToPreviousStep={[Function]}
-    submittable={true}
-  />
-</Fragment>
-`;
-
-exports[`StepTimeField should render any error message 1`] = `
-<Fragment>
-  <Header
-    indexPattern="ki*"
-    indexPatternName="name"
-  />
-  <EuiSpacer
-    size="m"
-  />
-  <TimeField
-    fetchTimeFields={[Function]}
-    isLoading={true}
-    isVisible={false}
-    onTimeFieldChanged={[Function]}
-    timeFieldOptions={Array []}
-  />
-  <EuiHorizontalRule />
-  <AdvancedOptions
-    indexPatternId=""
-    isVisible={false}
-    onChangeIndexPatternId={[Function]}
-    toggleAdvancedOptions={[Function]}
-  />
-  <EuiSpacer
-    size="m"
-  />
-  <EuiCallOut
-    color="danger"
-    iconType="cross"
-    title={
-      <FormattedMessage
-        defaultMessage="Error"
-        id="indexPatternManagement.createIndexPattern.stepTime.error"
-        values={Object {}}
-      />
-    }
-  >
-    <p>
-      foobar
-    </p>
-  </EuiCallOut>
-  <EuiSpacer
-    size="m"
-  />
-  <ActionButtons
-    createIndexPattern={[Function]}
-    goToPreviousStep={[Function]}
-    submittable={true}
-  />
-</Fragment>
-`;
-
-exports[`StepTimeField should render normally 1`] = `
-<Fragment>
-  <Header
-    indexPattern="ki*"
-    indexPatternName="name"
-  />
-  <EuiSpacer
-    size="m"
-  />
-  <TimeField
-    fetchTimeFields={[Function]}
-    isLoading={true}
-    isVisible={false}
-    onTimeFieldChanged={[Function]}
-    timeFieldOptions={Array []}
-  />
-  <EuiHorizontalRule />
-  <AdvancedOptions
-    indexPatternId=""
-    isVisible={false}
-    onChangeIndexPatternId={[Function]}
-    toggleAdvancedOptions={[Function]}
-  />
-  <EuiSpacer
-    size="m"
-  />
-  <ActionButtons
-    createIndexPattern={[Function]}
-    goToPreviousStep={[Function]}
-    submittable={true}
-  />
-</Fragment>
-`;
-
-exports[`StepTimeField should render timeFields 1`] = `
-<Fragment>
-  <Header
-    indexPattern="ki*"
-    indexPatternName="name"
-  />
-  <EuiSpacer
-    size="m"
-  />
-  <TimeField
-    fetchTimeFields={[Function]}
-    isLoading={true}
-    isVisible={true}
-    onTimeFieldChanged={[Function]}
-    timeFieldOptions={
-      Array [
-        Object {
-          "text": "",
-          "value": "",
-        },
-        Object {
-          "disabled": undefined,
-          "text": "@timestamp",
-          "value": "@timestamp",
-        },
-        Object {
-          "disabled": undefined,
-          "text": "name",
-          "value": "name",
-        },
-      ]
-    }
-  />
-  <EuiHorizontalRule />
-  <AdvancedOptions
-    indexPatternId=""
-    isVisible={false}
-    onChangeIndexPatternId={[Function]}
-    toggleAdvancedOptions={[Function]}
-  />
-  <EuiSpacer
-    size="m"
-  />
-  <ActionButtons
-    createIndexPattern={[Function]}
-    goToPreviousStep={[Function]}
-    submittable={false}
-  />
-</Fragment>
-`;
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/action_buttons/action_buttons.tsx b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/action_buttons/action_buttons.tsx
deleted file mode 100644
index 1f5b194fc25491..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/action_buttons/action_buttons.tsx
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-
-import { EuiFlexGroup, EuiFlexItem, EuiButton, EuiButtonEmpty } from '@elastic/eui';
-
-import { FormattedMessage } from '@kbn/i18n/react';
-
-export const ActionButtons = ({
-  goToPreviousStep,
-  submittable,
-  createIndexPattern,
-}: {
-  goToPreviousStep: () => void;
-  submittable: boolean;
-  createIndexPattern: () => void;
-}) => (
-  <EuiFlexGroup justifyContent="flexEnd">
-    <EuiFlexItem grow={false}>
-      <EuiButtonEmpty iconType="arrowLeft" onClick={goToPreviousStep}>
-        <FormattedMessage
-          id="indexPatternManagement.createIndexPattern.stepTime.backButton"
-          defaultMessage="Back"
-        />
-      </EuiButtonEmpty>
-    </EuiFlexItem>
-    <EuiFlexItem grow={false}>
-      <EuiButton
-        isDisabled={!submittable}
-        data-test-subj="createIndexPatternButton"
-        fill
-        onClick={createIndexPattern}
-      >
-        <FormattedMessage
-          id="indexPatternManagement.createIndexPattern.stepTime.createPatternButton"
-          defaultMessage="Create index pattern"
-        />
-      </EuiButton>
-    </EuiFlexItem>
-  </EuiFlexGroup>
-);
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/action_buttons/index.ts b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/action_buttons/index.ts
deleted file mode 100644
index 56f13b55bc6bea..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/action_buttons/index.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-export { ActionButtons } from './action_buttons';
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/advanced_options/__snapshots__/advanced_options.test.tsx.snap b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/advanced_options/__snapshots__/advanced_options.test.tsx.snap
deleted file mode 100644
index a2d2023ea06016..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/advanced_options/__snapshots__/advanced_options.test.tsx.snap
+++ /dev/null
@@ -1,69 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`AdvancedOptions should hide if not showing 1`] = `
-<div>
-  <EuiButtonEmpty
-    iconType="arrowRight"
-    onClick={[Function]}
-  >
-    <FormattedMessage
-      defaultMessage="Show advanced settings"
-      id="indexPatternManagement.createIndexPattern.stepTime.options.showButton"
-      values={Object {}}
-    />
-  </EuiButtonEmpty>
-  <EuiSpacer
-    size="xs"
-  />
-</div>
-`;
-
-exports[`AdvancedOptions should render normally 1`] = `
-<div>
-  <EuiButtonEmpty
-    iconType="arrowDown"
-    onClick={[Function]}
-  >
-    <FormattedMessage
-      defaultMessage="Hide advanced settings"
-      id="indexPatternManagement.createIndexPattern.stepTime.options.hideButton"
-      values={Object {}}
-    />
-  </EuiButtonEmpty>
-  <EuiSpacer
-    size="xs"
-  />
-  <EuiForm>
-    <EuiFormRow
-      describedByIds={Array []}
-      display="row"
-      fullWidth={false}
-      hasChildLabel={true}
-      hasEmptyLabelSpace={false}
-      helpText={
-        <FormattedMessage
-          defaultMessage="Kibana will provide a unique identifier for each index pattern. If you do not want to use this unique ID, enter a custom one."
-          id="indexPatternManagement.createIndexPattern.stepTime.options.patternLabel"
-          values={Object {}}
-        />
-      }
-      label={
-        <FormattedMessage
-          defaultMessage="Custom index pattern ID"
-          id="indexPatternManagement.createIndexPattern.stepTime.options.patternHeader"
-          values={Object {}}
-        />
-      }
-      labelType="label"
-    >
-      <EuiFieldText
-        data-test-subj="createIndexPatternIdInput"
-        name="indexPatternId"
-        onChange={[Function]}
-        placeholder="custom-index-pattern-id"
-        value="foobar"
-      />
-    </EuiFormRow>
-  </EuiForm>
-</div>
-`;
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/advanced_options/advanced_options.test.tsx b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/advanced_options/advanced_options.test.tsx
deleted file mode 100644
index 0341a760c535fe..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/advanced_options/advanced_options.test.tsx
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-import { AdvancedOptions } from '../advanced_options';
-import { shallowWithI18nProvider } from '@kbn/test/jest';
-
-describe('AdvancedOptions', () => {
-  it('should render normally', () => {
-    const component = shallowWithI18nProvider(
-      <AdvancedOptions
-        isVisible={true}
-        indexPatternId={'foobar'}
-        toggleAdvancedOptions={() => {}}
-        onChangeIndexPatternId={() => {}}
-      />
-    );
-
-    expect(component).toMatchSnapshot();
-  });
-
-  it('should hide if not showing', () => {
-    const component = shallowWithI18nProvider(
-      <AdvancedOptions
-        isVisible={false}
-        indexPatternId={'foobar'}
-        toggleAdvancedOptions={() => {}}
-        onChangeIndexPatternId={() => {}}
-      />
-    );
-
-    expect(component).toMatchSnapshot();
-  });
-});
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/advanced_options/advanced_options.tsx b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/advanced_options/advanced_options.tsx
deleted file mode 100644
index 665972c5461581..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/advanced_options/advanced_options.tsx
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-
-import { EuiForm, EuiFormRow, EuiFieldText, EuiButtonEmpty, EuiSpacer } from '@elastic/eui';
-
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
-
-interface AdvancedOptionsProps {
-  isVisible: boolean;
-  indexPatternId: string;
-  toggleAdvancedOptions: (e: React.FormEvent<HTMLButtonElement>) => void;
-  onChangeIndexPatternId: (e: React.ChangeEvent<HTMLInputElement>) => void;
-}
-
-export const AdvancedOptions: React.FC<AdvancedOptionsProps> = ({
-  isVisible,
-  indexPatternId,
-  toggleAdvancedOptions,
-  onChangeIndexPatternId,
-}) => (
-  <div>
-    <EuiButtonEmpty
-      iconType={isVisible ? 'arrowDown' : 'arrowRight'}
-      onClick={toggleAdvancedOptions}
-    >
-      {isVisible ? (
-        <FormattedMessage
-          id="indexPatternManagement.createIndexPattern.stepTime.options.hideButton"
-          defaultMessage="Hide advanced settings"
-        />
-      ) : (
-        <FormattedMessage
-          id="indexPatternManagement.createIndexPattern.stepTime.options.showButton"
-          defaultMessage="Show advanced settings"
-        />
-      )}
-    </EuiButtonEmpty>
-    <EuiSpacer size="xs" />
-    {isVisible ? (
-      <EuiForm>
-        <EuiFormRow
-          label={
-            <FormattedMessage
-              id="indexPatternManagement.createIndexPattern.stepTime.options.patternHeader"
-              defaultMessage="Custom index pattern ID"
-            />
-          }
-          helpText={
-            <FormattedMessage
-              id="indexPatternManagement.createIndexPattern.stepTime.options.patternLabel"
-              defaultMessage="Kibana will provide a unique identifier for each index pattern. If you do not want to use this unique ID,
-            enter a custom one."
-            />
-          }
-        >
-          <EuiFieldText
-            name="indexPatternId"
-            data-test-subj="createIndexPatternIdInput"
-            value={indexPatternId}
-            onChange={onChangeIndexPatternId}
-            placeholder={i18n.translate(
-              'indexPatternManagement.createIndexPattern.stepTime.options.patternPlaceholder',
-              {
-                defaultMessage: 'custom-index-pattern-id',
-              }
-            )}
-          />
-        </EuiFormRow>
-      </EuiForm>
-    ) : null}
-  </div>
-);
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/advanced_options/index.ts b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/advanced_options/index.ts
deleted file mode 100644
index 23ebc3a8c3f669..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/advanced_options/index.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-export { AdvancedOptions } from './advanced_options';
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/header/__snapshots__/header.test.tsx.snap b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/header/__snapshots__/header.test.tsx.snap
deleted file mode 100644
index 9efda4fdac7f91..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/header/__snapshots__/header.test.tsx.snap
+++ /dev/null
@@ -1,34 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`Header should render normally 1`] = `
-<div>
-  <EuiTitle
-    size="s"
-  >
-    <h2>
-      <FormattedMessage
-        defaultMessage="Step 2 of 2: Configure settings"
-        id="indexPatternManagement.createIndexPattern.stepTimeHeader"
-        values={Object {}}
-      />
-    </h2>
-  </EuiTitle>
-  <EuiSpacer
-    size="m"
-  />
-  <EuiText>
-    <FormattedMessage
-      defaultMessage="Specify settings for your {indexPattern} {indexPatternName}."
-      id="indexPatternManagement.createIndexPattern.stepTimeLabel"
-      values={
-        Object {
-          "indexPattern": <strong>
-            ki*
-          </strong>,
-          "indexPatternName": "ki*",
-        }
-      }
-    />
-  </EuiText>
-</div>
-`;
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/header/header.tsx b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/header/header.tsx
deleted file mode 100644
index 41cae957def2b5..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/header/header.tsx
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-
-import { EuiTitle, EuiSpacer, EuiText } from '@elastic/eui';
-
-import { FormattedMessage } from '@kbn/i18n/react';
-
-interface HeaderProps {
-  indexPattern: string;
-  indexPatternName: string;
-}
-
-export const Header: React.FC<HeaderProps> = ({ indexPattern, indexPatternName }) => (
-  <div>
-    <EuiTitle size="s">
-      <h2>
-        <FormattedMessage
-          id="indexPatternManagement.createIndexPattern.stepTimeHeader"
-          defaultMessage="Step 2 of 2: Configure settings"
-        />
-      </h2>
-    </EuiTitle>
-    <EuiSpacer size="m" />
-    <EuiText>
-      <FormattedMessage
-        id="indexPatternManagement.createIndexPattern.stepTimeLabel"
-        defaultMessage="Specify settings for your {indexPattern} {indexPatternName}."
-        values={{
-          indexPattern: <strong>{indexPattern}</strong>,
-          indexPatternName,
-        }}
-      />
-    </EuiText>
-  </div>
-);
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/time_field/__snapshots__/time_field.test.tsx.snap b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/time_field/__snapshots__/time_field.test.tsx.snap
deleted file mode 100644
index 73277b1963626b..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/time_field/__snapshots__/time_field.test.tsx.snap
+++ /dev/null
@@ -1,188 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`TimeField should render a loading state 1`] = `
-<EuiForm>
-  <EuiText>
-    <p>
-      <FormattedMessage
-        defaultMessage="Select a primary time field for use with the global time filter."
-        id="indexPatternManagement.createIndexPattern.stepTime.timeDescription"
-        values={Object {}}
-      />
-    </p>
-  </EuiText>
-  <EuiSpacer />
-  <EuiFormRow
-    describedByIds={Array []}
-    display="row"
-    fullWidth={false}
-    hasChildLabel={true}
-    hasEmptyLabelSpace={false}
-    label={
-      <FormattedMessage
-        defaultMessage="Time field"
-        id="indexPatternManagement.createIndexPattern.stepTime.fieldLabel"
-        values={Object {}}
-      />
-    }
-    labelAppend={
-      <EuiLoadingSpinner
-        size="s"
-      />
-    }
-    labelType="label"
-  >
-    <EuiSelect
-      data-test-subj="createIndexPatternTimeFieldSelect"
-      disabled={true}
-      name="timeField"
-      options={
-        Array [
-          Object {
-            "text": "Loading…",
-            "value": "",
-          },
-        ]
-      }
-    />
-  </EuiFormRow>
-</EuiForm>
-`;
-
-exports[`TimeField should render a selected time field 1`] = `
-<EuiForm>
-  <EuiText>
-    <p>
-      <FormattedMessage
-        defaultMessage="Select a primary time field for use with the global time filter."
-        id="indexPatternManagement.createIndexPattern.stepTime.timeDescription"
-        values={Object {}}
-      />
-    </p>
-  </EuiText>
-  <EuiSpacer />
-  <EuiFormRow
-    describedByIds={Array []}
-    display="row"
-    fullWidth={false}
-    hasChildLabel={true}
-    hasEmptyLabelSpace={false}
-    label={
-      <FormattedMessage
-        defaultMessage="Time field"
-        id="indexPatternManagement.createIndexPattern.stepTime.fieldLabel"
-        values={Object {}}
-      />
-    }
-    labelAppend={
-      <EuiText
-        size="xs"
-      >
-        <EuiLink
-          onClick={[Function]}
-        >
-          <FormattedMessage
-            defaultMessage="Refresh"
-            id="indexPatternManagement.createIndexPattern.stepTime.refreshButton"
-            values={Object {}}
-          />
-        </EuiLink>
-      </EuiText>
-    }
-    labelType="label"
-  >
-    <EuiSelect
-      data-test-subj="createIndexPatternTimeFieldSelect"
-      disabled={false}
-      isLoading={false}
-      name="timeField"
-      onChange={[Function]}
-      options={
-        Array [
-          Object {
-            "text": "@timestamp",
-            "value": "@timestamp",
-          },
-        ]
-      }
-      value="@timestamp"
-    />
-  </EuiFormRow>
-</EuiForm>
-`;
-
-exports[`TimeField should render normally 1`] = `
-<EuiForm>
-  <EuiText>
-    <p>
-      <FormattedMessage
-        defaultMessage="Select a primary time field for use with the global time filter."
-        id="indexPatternManagement.createIndexPattern.stepTime.timeDescription"
-        values={Object {}}
-      />
-    </p>
-  </EuiText>
-  <EuiSpacer />
-  <EuiFormRow
-    describedByIds={Array []}
-    display="row"
-    fullWidth={false}
-    hasChildLabel={true}
-    hasEmptyLabelSpace={false}
-    label={
-      <FormattedMessage
-        defaultMessage="Time field"
-        id="indexPatternManagement.createIndexPattern.stepTime.fieldLabel"
-        values={Object {}}
-      />
-    }
-    labelAppend={
-      <EuiText
-        size="xs"
-      >
-        <EuiLink
-          onClick={[Function]}
-        >
-          <FormattedMessage
-            defaultMessage="Refresh"
-            id="indexPatternManagement.createIndexPattern.stepTime.refreshButton"
-            values={Object {}}
-          />
-        </EuiLink>
-      </EuiText>
-    }
-    labelType="label"
-  >
-    <EuiSelect
-      data-test-subj="createIndexPatternTimeFieldSelect"
-      disabled={false}
-      isLoading={false}
-      name="timeField"
-      onChange={[Function]}
-      options={
-        Array [
-          Object {
-            "text": "@timestamp",
-            "value": "@timestamp",
-          },
-        ]
-      }
-      value=""
-    />
-  </EuiFormRow>
-</EuiForm>
-`;
-
-exports[`TimeField should render something if hiding time field 1`] = `
-<EuiForm>
-  <EuiText>
-    <p>
-      <FormattedMessage
-        defaultMessage="The indices which match this index pattern don't contain any time fields."
-        id="indexPatternManagement.createIndexPattern.stepTime.field.noTimeFieldsLabel"
-        values={Object {}}
-      />
-    </p>
-  </EuiText>
-</EuiForm>
-`;
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/time_field/index.ts b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/time_field/index.ts
deleted file mode 100644
index 7dba3ecc1f75fb..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/time_field/index.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-export { TimeField } from './time_field';
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/time_field/time_field.test.tsx b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/time_field/time_field.test.tsx
deleted file mode 100644
index 1f16842f3c89de..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/time_field/time_field.test.tsx
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-import { TimeField } from '../time_field';
-import { shallowWithI18nProvider } from '@kbn/test/jest';
-
-describe('TimeField', () => {
-  it('should render normally', () => {
-    const component = shallowWithI18nProvider(
-      <TimeField
-        isVisible={true}
-        fetchTimeFields={() => {}}
-        timeFieldOptions={[{ text: '@timestamp', value: '@timestamp' }]}
-        isLoading={false}
-        selectedTimeField={''}
-        onTimeFieldChanged={() => {}}
-      />
-    );
-
-    expect(component).toMatchSnapshot();
-  });
-
-  it('should render something if hiding time field', () => {
-    const component = shallowWithI18nProvider(
-      <TimeField
-        isVisible={false}
-        fetchTimeFields={() => {}}
-        timeFieldOptions={[{ text: '@timestamp', value: '@timestamp' }]}
-        isLoading={false}
-        selectedTimeField={''}
-        onTimeFieldChanged={() => {}}
-      />
-    );
-
-    expect(component).toMatchSnapshot();
-  });
-
-  it('should render a selected time field', () => {
-    const component = shallowWithI18nProvider(
-      <TimeField
-        isVisible={true}
-        fetchTimeFields={() => {}}
-        timeFieldOptions={[{ text: '@timestamp', value: '@timestamp' }]}
-        isLoading={false}
-        selectedTimeField={'@timestamp'}
-        onTimeFieldChanged={() => {}}
-      />
-    );
-
-    expect(component).toMatchSnapshot();
-  });
-
-  it('should render a loading state', () => {
-    const component = shallowWithI18nProvider(
-      <TimeField
-        isVisible={true}
-        fetchTimeFields={() => {}}
-        timeFieldOptions={[{ text: '@timestamp', value: '@timestamp' }]}
-        isLoading={true}
-        selectedTimeField={'@timestamp'}
-        onTimeFieldChanged={() => {}}
-      />
-    );
-
-    expect(component).toMatchSnapshot();
-  });
-});
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/time_field/time_field.tsx b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/time_field/time_field.tsx
deleted file mode 100644
index 7fac76eb847cdf..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/components/time_field/time_field.tsx
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-
-import {
-  EuiForm,
-  EuiFormRow,
-  EuiSpacer,
-  EuiLink,
-  EuiSelect,
-  EuiText,
-  EuiLoadingSpinner,
-} from '@elastic/eui';
-
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
-
-interface TimeFieldProps {
-  isVisible: boolean;
-  fetchTimeFields: () => void;
-  timeFieldOptions: Array<{ text: string; value?: string }>;
-  isLoading: boolean;
-  selectedTimeField?: string;
-  onTimeFieldChanged: (e: React.ChangeEvent<HTMLSelectElement>) => void;
-}
-
-export const TimeField: React.FC<TimeFieldProps> = ({
-  isVisible,
-  fetchTimeFields,
-  timeFieldOptions,
-  isLoading,
-  selectedTimeField,
-  onTimeFieldChanged,
-}) => (
-  <EuiForm>
-    {isVisible ? (
-      <>
-        <EuiText>
-          <p>
-            <FormattedMessage
-              id="indexPatternManagement.createIndexPattern.stepTime.timeDescription"
-              defaultMessage="Select a primary time field for use with the global time filter."
-            />
-          </p>
-        </EuiText>
-        <EuiSpacer />
-        <EuiFormRow
-          label={
-            <FormattedMessage
-              id="indexPatternManagement.createIndexPattern.stepTime.fieldLabel"
-              defaultMessage="Time field"
-            />
-          }
-          labelAppend={
-            isLoading ? (
-              <EuiLoadingSpinner size="s" />
-            ) : (
-              <EuiText size="xs">
-                <EuiLink onClick={fetchTimeFields}>
-                  <FormattedMessage
-                    id="indexPatternManagement.createIndexPattern.stepTime.refreshButton"
-                    defaultMessage="Refresh"
-                  />
-                </EuiLink>
-              </EuiText>
-            )
-          }
-        >
-          {isLoading ? (
-            <EuiSelect
-              name="timeField"
-              data-test-subj="createIndexPatternTimeFieldSelect"
-              options={[
-                {
-                  text: i18n.translate(
-                    'indexPatternManagement.createIndexPattern.stepTime.field.loadingDropDown',
-                    {
-                      defaultMessage: 'Loading…',
-                    }
-                  ),
-                  value: '',
-                },
-              ]}
-              disabled={true}
-            />
-          ) : (
-            <EuiSelect
-              name="timeField"
-              data-test-subj="createIndexPatternTimeFieldSelect"
-              options={timeFieldOptions}
-              isLoading={isLoading}
-              disabled={isLoading}
-              value={selectedTimeField}
-              onChange={onTimeFieldChanged}
-            />
-          )}
-        </EuiFormRow>
-      </>
-    ) : (
-      <EuiText>
-        <p>
-          <FormattedMessage
-            id="indexPatternManagement.createIndexPattern.stepTime.field.noTimeFieldsLabel"
-            defaultMessage="The indices which match this index pattern don't contain any time fields."
-          />
-        </p>
-      </EuiText>
-    )}
-  </EuiForm>
-);
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/index.ts b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/index.ts
deleted file mode 100644
index 4591dc5ae83dca..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/index.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-export { StepTimeField } from './step_time_field';
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/step_time_field.test.tsx b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/step_time_field.test.tsx
deleted file mode 100644
index fabc6ec69b0eeb..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/step_time_field.test.tsx
+++ /dev/null
@@ -1,331 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-import { IndexPatternCreationConfig } from '../../../../../../../plugins/index_pattern_management/public';
-import { IndexPatternField } from '../../../../../../../plugins/data/public';
-import { mockManagementPlugin } from '../../../../mocks';
-import { createComponentWithContext } from '../../../test_utils';
-
-import { StepTimeField } from '../step_time_field';
-
-jest.mock('./components/header', () => ({ Header: 'Header' }));
-jest.mock('./components/time_field', () => ({ TimeField: 'TimeField' }));
-jest.mock('./components/advanced_options', () => ({ AdvancedOptions: 'AdvancedOptions' }));
-jest.mock('./components/action_buttons', () => ({ ActionButtons: 'ActionButtons' }));
-jest.mock('./../../lib', () => ({
-  extractTimeFields: jest.requireActual('./../../lib').extractTimeFields,
-  ensureMinimumTime: async (fields: IndexPatternField) => Promise.resolve(fields),
-}));
-
-const mockIndexPatternCreationType = new IndexPatternCreationConfig({
-  type: 'default',
-  name: 'name',
-});
-
-const noop = () => {};
-const mockContext = mockManagementPlugin.createIndexPatternManagmentContext();
-const fields = [
-  {
-    name: '@timestamp',
-    type: 'date',
-  },
-];
-mockContext.data.indexPatterns = {
-  create: () => ({}),
-  getFieldsForWildcard: jest.fn().mockReturnValue(Promise.resolve(fields)),
-} as any;
-
-describe('StepTimeField', () => {
-  it('should render normally', () => {
-    const component = createComponentWithContext(
-      StepTimeField,
-      {
-        indexPattern: 'ki*',
-        goToPreviousStep: noop,
-        createIndexPattern: noop,
-        indexPatternCreationType: mockIndexPatternCreationType,
-      },
-      mockContext
-    );
-
-    expect(component).toMatchSnapshot();
-  });
-
-  it('should render timeFields', () => {
-    const component = createComponentWithContext(
-      StepTimeField,
-      {
-        indexPattern: 'ki*',
-        goToPreviousStep: noop,
-        createIndexPattern: noop,
-        indexPatternCreationType: mockIndexPatternCreationType,
-      },
-      mockContext
-    );
-
-    component.setState({
-      timeFields: [
-        { display: '@timestamp', fieldName: '@timestamp' },
-        { display: 'name', fieldName: 'name' },
-      ],
-    });
-
-    expect(component).toMatchSnapshot();
-  });
-
-  it('should render a selected timeField', () => {
-    const component = createComponentWithContext(
-      StepTimeField,
-      {
-        indexPattern: 'ki*',
-        goToPreviousStep: noop,
-        createIndexPattern: noop,
-        indexPatternCreationType: mockIndexPatternCreationType,
-      },
-      mockContext
-    );
-
-    component.setState({
-      timeFields: [
-        { display: '@timestamp', fieldName: '@timestamp' },
-        { display: 'name', fieldName: 'name' },
-      ],
-      selectedTimeField: '@timestamp',
-      timeFieldSet: true,
-    });
-
-    expect(component).toMatchSnapshot();
-  });
-
-  it('should ensure disabled time field options work properly', () => {
-    const component = createComponentWithContext(
-      StepTimeField,
-      {
-        indexPattern: 'ki*',
-        goToPreviousStep: noop,
-        createIndexPattern: noop,
-        indexPatternCreationType: mockIndexPatternCreationType,
-      },
-      mockContext
-    );
-
-    component.setState({
-      timeFields: [
-        { display: '@timestamp', fieldName: '@timestamp' },
-        { display: 'name', fieldName: 'name' },
-      ],
-    });
-
-    // If the value is undefined, that means the user selected the
-    // `I don't want to use a Time filter` option
-    (component.instance() as StepTimeField).onTimeFieldChanged(({
-      target: { value: undefined },
-    } as unknown) as React.ChangeEvent<HTMLSelectElement>);
-    expect(component.state('timeFieldSet')).toBe(true);
-
-    // If the value is an empty string, that means the user selected
-    // an invalid selection (like the empty selection or the `-----`)
-    (component.instance() as StepTimeField).onTimeFieldChanged(({
-      target: { value: '' },
-    } as unknown) as React.ChangeEvent<HTMLSelectElement>);
-    expect(component.state('timeFieldSet')).toBe(false);
-  });
-
-  it('should disable the action button if an invalid time field is selected', () => {
-    const component = createComponentWithContext(
-      StepTimeField,
-      {
-        indexPattern: 'ki*',
-        goToPreviousStep: noop,
-        createIndexPattern: noop,
-        indexPatternCreationType: mockIndexPatternCreationType,
-      },
-      mockContext
-    );
-
-    component.setState({
-      timeFields: [
-        { display: '@timestamp', fieldName: '@timestamp' },
-        { display: 'name', fieldName: 'name' },
-      ],
-    });
-
-    (component.instance() as StepTimeField).onTimeFieldChanged(({
-      target: { value: '' },
-    } as unknown) as React.ChangeEvent<HTMLSelectElement>);
-    component.update();
-
-    expect(component.find('ActionButtons')).toMatchSnapshot();
-  });
-
-  it('should enable the action button if the user decides to not select a time field', () => {
-    const component = createComponentWithContext(
-      StepTimeField,
-      {
-        indexPattern: 'ki*',
-        goToPreviousStep: noop,
-        createIndexPattern: noop,
-        indexPatternCreationType: mockIndexPatternCreationType,
-      },
-      mockContext
-    );
-
-    component.setState({
-      timeFields: [
-        { display: '@timestamp', fieldName: '@timestamp' },
-        { display: 'name', fieldName: 'name' },
-      ],
-    });
-
-    (component.instance() as StepTimeField).onTimeFieldChanged(({
-      target: { value: undefined },
-    } as unknown) as React.ChangeEvent<HTMLSelectElement>);
-    component.update();
-
-    expect(component.find('ActionButtons')).toMatchSnapshot();
-  });
-
-  it('should render advanced options', () => {
-    const component = createComponentWithContext(
-      StepTimeField,
-      {
-        indexPattern: 'ki*',
-        goToPreviousStep: noop,
-        createIndexPattern: noop,
-        indexPatternCreationType: mockIndexPatternCreationType,
-      },
-      mockContext
-    );
-
-    component.setState({ showingAdvancedOptions: true });
-
-    expect(component).toMatchSnapshot();
-  });
-
-  it('should render advanced options with an index pattern id', () => {
-    const component = createComponentWithContext(
-      StepTimeField,
-      {
-        indexPattern: 'ki*',
-        goToPreviousStep: noop,
-        createIndexPattern: noop,
-        indexPatternCreationType: mockIndexPatternCreationType,
-      },
-      mockContext
-    );
-
-    component.setState({
-      showingAdvancedOptions: true,
-      indexPatternId: 'foobar',
-    });
-
-    expect(component).toMatchSnapshot();
-  });
-
-  it('should render a loading state when creating the index pattern', () => {
-    const component = createComponentWithContext(
-      StepTimeField,
-      {
-        indexPattern: 'ki*',
-        goToPreviousStep: noop,
-        createIndexPattern: noop,
-        indexPatternCreationType: mockIndexPatternCreationType,
-      },
-      mockContext
-    );
-
-    component.setState({ isCreating: true });
-
-    expect(component).toMatchSnapshot();
-  });
-
-  it('should render any error message', () => {
-    const component = createComponentWithContext(
-      StepTimeField,
-      {
-        indexPattern: 'ki*',
-        goToPreviousStep: noop,
-        createIndexPattern: noop,
-        indexPatternCreationType: mockIndexPatternCreationType,
-      },
-      mockContext
-    );
-
-    component.setState({ error: 'foobar' });
-
-    expect(component).toMatchSnapshot();
-  });
-
-  it('should render "Custom index pattern ID already exists" when error is "Conflict"', () => {
-    const component = createComponentWithContext(
-      StepTimeField,
-      {
-        indexPattern: 'ki*',
-        goToPreviousStep: noop,
-        createIndexPattern: noop,
-        indexPatternCreationType: mockIndexPatternCreationType,
-      },
-      mockContext
-    );
-
-    component.setState({ error: 'Conflict' });
-
-    expect(component).toMatchSnapshot();
-  });
-
-  it('should remember error thrown by createIndexPatter() prop', async () => {
-    const createIndexPattern = async () => {
-      throw new Error('foobar');
-    };
-    const component = createComponentWithContext(
-      StepTimeField,
-      {
-        indexPattern: 'ki*',
-        goToPreviousStep: noop,
-        createIndexPattern,
-        indexPatternCreationType: mockIndexPatternCreationType,
-      },
-      mockContext
-    );
-
-    await (component.instance() as StepTimeField).createIndexPattern();
-    component.update();
-
-    expect(component.instance().state).toMatchObject({
-      error: 'foobar',
-    });
-  });
-
-  it('should call createIndexPattern with undefined time field when no time filter chosen', async () => {
-    const createIndexPattern = jest.fn();
-
-    const component = createComponentWithContext(
-      StepTimeField,
-      {
-        indexPattern: 'ki*',
-        goToPreviousStep: noop,
-        createIndexPattern,
-        indexPatternCreationType: mockIndexPatternCreationType,
-      },
-      mockContext
-    );
-
-    await (component.instance() as StepTimeField).fetchTimeFields();
-
-    expect((component.state() as any).timeFields).toHaveLength(3);
-
-    (component.instance() as StepTimeField).onTimeFieldChanged(({
-      target: { value: undefined },
-    } as unknown) as React.ChangeEvent<HTMLSelectElement>);
-
-    await (component.instance() as StepTimeField).createIndexPattern();
-
-    expect(createIndexPattern).toHaveBeenCalledWith(undefined, '');
-  });
-});
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/step_time_field.tsx b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/step_time_field.tsx
deleted file mode 100644
index f489132946ec79..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/step_time_field/step_time_field.tsx
+++ /dev/null
@@ -1,262 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React, { Component } from 'react';
-import {
-  EuiCallOut,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiTitle,
-  EuiSpacer,
-  EuiLoadingSpinner,
-  EuiHorizontalRule,
-} from '@elastic/eui';
-import { FormattedMessage } from '@kbn/i18n/react';
-import { ensureMinimumTime, extractTimeFields } from '../../lib';
-
-import { Header } from './components/header';
-import { TimeField } from './components/time_field';
-import { AdvancedOptions } from './components/advanced_options';
-import { ActionButtons } from './components/action_buttons';
-import { context } from '../../../../../../kibana_react/public';
-import { IndexPatternManagmentContextValue } from '../../../../types';
-import { IndexPatternCreationConfig } from '../../../..';
-
-interface StepTimeFieldProps {
-  indexPattern: string;
-  goToPreviousStep: () => void;
-  createIndexPattern: (selectedTimeField: string | undefined, indexPatternId: string) => void;
-  indexPatternCreationType: IndexPatternCreationConfig;
-  selectedTimeField?: string;
-}
-
-interface StepTimeFieldState {
-  error: string;
-  timeFields: TimeFieldConfig[];
-  selectedTimeField?: string;
-  timeFieldSet: boolean;
-  isAdvancedOptionsVisible: boolean;
-  isFetchingTimeFields: boolean;
-  isCreating: boolean;
-  indexPatternId: string;
-  indexPatternType: string;
-  indexPatternName: string;
-}
-
-interface TimeFieldConfig {
-  display: string;
-  fieldName?: string;
-  isDisabled?: boolean;
-}
-
-export class StepTimeField extends Component<StepTimeFieldProps, StepTimeFieldState> {
-  static contextType = context;
-
-  public readonly context!: IndexPatternManagmentContextValue;
-
-  state: StepTimeFieldState = {
-    error: '',
-    timeFields: [],
-    selectedTimeField: undefined,
-    timeFieldSet: false,
-    isAdvancedOptionsVisible: false,
-    isFetchingTimeFields: false,
-    isCreating: false,
-    indexPatternId: '',
-    indexPatternType: '',
-    indexPatternName: '',
-  };
-
-  constructor(props: StepTimeFieldProps) {
-    super(props);
-    this.state.indexPatternType = props.indexPatternCreationType.getIndexPatternType() || '';
-    this.state.indexPatternName = props.indexPatternCreationType.getIndexPatternName();
-    this.state.selectedTimeField = props.selectedTimeField;
-    if (props.selectedTimeField) {
-      this.state.timeFieldSet = true;
-    }
-  }
-
-  mounted = false;
-
-  componentDidMount() {
-    this.mounted = true;
-    this.fetchTimeFields();
-  }
-
-  componentWillUnmount() {
-    this.mounted = false;
-  }
-
-  fetchTimeFields = async () => {
-    const { indexPattern: pattern } = this.props;
-    const { getFetchForWildcardOptions } = this.props.indexPatternCreationType;
-
-    this.setState({ isFetchingTimeFields: true });
-    const fields = await ensureMinimumTime(
-      this.context.services.data.indexPatterns.getFieldsForWildcard({
-        pattern,
-        ...getFetchForWildcardOptions(),
-      })
-    );
-    const timeFields = extractTimeFields(fields);
-
-    this.setState({ timeFields, isFetchingTimeFields: false });
-  };
-
-  onTimeFieldChanged = (e: React.ChangeEvent<HTMLSelectElement>) => {
-    const value = e.target.value;
-
-    // Find the time field based on the selected value
-    const timeField = this.state.timeFields.find(
-      (timeFld: TimeFieldConfig) => timeFld.fieldName === value
-    );
-
-    // If the value is an empty string, it's not a valid selection
-    const validSelection = value !== '';
-
-    this.setState({
-      selectedTimeField: timeField ? (timeField as TimeFieldConfig).fieldName : undefined,
-      timeFieldSet: validSelection,
-    });
-  };
-
-  onChangeIndexPatternId = (e: React.ChangeEvent<HTMLInputElement>) => {
-    this.setState({ indexPatternId: e.target.value });
-  };
-
-  toggleAdvancedOptions = () => {
-    this.setState((state) => ({
-      isAdvancedOptionsVisible: !state.isAdvancedOptionsVisible,
-    }));
-  };
-
-  createIndexPattern = async () => {
-    const { createIndexPattern } = this.props;
-    const { selectedTimeField, indexPatternId } = this.state;
-    this.setState({ isCreating: true });
-    try {
-      await createIndexPattern(selectedTimeField, indexPatternId);
-    } catch (error) {
-      if (!this.mounted) return;
-      this.setState({
-        error: error instanceof Error ? error.message : String(error),
-        isCreating: false,
-      });
-    }
-  };
-
-  formatErrorMessage(message: string) {
-    // `createIndexPattern` throws "Conflict" when index pattern ID already exists.
-    return message === 'Conflict' ? (
-      <FormattedMessage
-        id="indexPatternManagement.createIndexPattern.stepTime.patterAlreadyExists"
-        defaultMessage="Custom index pattern ID already exists."
-      />
-    ) : (
-      message
-    );
-  }
-
-  render() {
-    const {
-      timeFields,
-      selectedTimeField,
-      timeFieldSet,
-      isAdvancedOptionsVisible,
-      indexPatternId,
-      isCreating,
-      isFetchingTimeFields,
-      indexPatternName,
-    } = this.state;
-
-    if (isCreating) {
-      return (
-        <EuiFlexGroup justifyContent="center" alignItems="center" direction="column" gutterSize="s">
-          <EuiFlexItem grow={false}>
-            <EuiTitle size="s">
-              <h3 className="eui-textCenter">
-                <FormattedMessage
-                  id="indexPatternManagement.createIndexPattern.stepTime.creatingLabel"
-                  defaultMessage="Creating index pattern…"
-                />
-              </h3>
-            </EuiTitle>
-          </EuiFlexItem>
-
-          <EuiFlexItem grow={false}>
-            <EuiLoadingSpinner size="l" />
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      );
-    }
-
-    const { indexPattern, goToPreviousStep } = this.props;
-
-    const timeFieldOptions =
-      timeFields.length > 0
-        ? [
-            { text: '', value: '' },
-            ...timeFields.map((timeField: TimeFieldConfig) => ({
-              text: timeField.display,
-              value: timeField.fieldName,
-              disabled: ((timeFields as unknown) as TimeFieldConfig).isDisabled,
-            })),
-          ]
-        : [];
-
-    const showTimeField = !timeFields || timeFields.length > 1;
-    const submittable = !showTimeField || timeFieldSet;
-    const error = this.state.error ? (
-      <>
-        <EuiCallOut
-          title={
-            <FormattedMessage
-              id="indexPatternManagement.createIndexPattern.stepTime.error"
-              defaultMessage="Error"
-            />
-          }
-          color="danger"
-          iconType="cross"
-        >
-          <p>{this.formatErrorMessage(this.state.error)}</p>
-        </EuiCallOut>
-        <EuiSpacer size="m" />
-      </>
-    ) : null;
-
-    return (
-      <>
-        <Header indexPattern={indexPattern} indexPatternName={indexPatternName} />
-        <EuiSpacer size="m" />
-        <TimeField
-          isVisible={showTimeField}
-          fetchTimeFields={this.fetchTimeFields}
-          timeFieldOptions={timeFieldOptions}
-          isLoading={isFetchingTimeFields}
-          selectedTimeField={selectedTimeField}
-          onTimeFieldChanged={this.onTimeFieldChanged}
-        />
-        <EuiHorizontalRule />
-        <AdvancedOptions
-          isVisible={isAdvancedOptionsVisible}
-          indexPatternId={indexPatternId}
-          toggleAdvancedOptions={this.toggleAdvancedOptions}
-          onChangeIndexPatternId={this.onChangeIndexPatternId}
-        />
-        <EuiSpacer size="m" />
-        {error}
-        <ActionButtons
-          goToPreviousStep={goToPreviousStep}
-          submittable={submittable}
-          createIndexPattern={this.createIndexPattern}
-        />
-      </>
-    );
-  }
-}
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/constants/index.ts b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/constants/index.ts
deleted file mode 100644
index 8bc64bdaa490fe..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/constants/index.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-// This isn't ideal. We want to avoid searching for 20 indices
-// then filtering out the majority of them because they are system indices.
-// We'd like to filter system indices out in the query
-// so if we can accomplish that in the future, this logic can go away
-export const ESTIMATED_NUMBER_OF_SYSTEM_INDICES = 100;
-export const MAX_NUMBER_OF_MATCHING_INDICES = 100;
-export const MAX_SEARCH_SIZE = MAX_NUMBER_OF_MATCHING_INDICES + ESTIMATED_NUMBER_OF_SYSTEM_INDICES;
-
-export const PER_PAGE_INCREMENTS = [5, 10, 20, 50];
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/create_index_pattern_wizard.test.tsx b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/create_index_pattern_wizard.test.tsx
deleted file mode 100644
index a6c7e71445ae3a..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/create_index_pattern_wizard.test.tsx
+++ /dev/null
@@ -1,162 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { CreateIndexPatternWizard } from './create_index_pattern_wizard';
-import { IndexPattern } from '../../../../../plugins/data/public';
-import { mockManagementPlugin } from '../../mocks';
-import { IndexPatternCreationConfig } from '../../';
-import { createComponentWithContext } from '../test_utils';
-
-jest.mock('./components/step_index_pattern', () => ({ StepIndexPattern: 'StepIndexPattern' }));
-jest.mock('./components/step_time_field', () => ({ StepTimeField: 'StepTimeField' }));
-jest.mock('./components/header', () => ({ Header: 'Header' }));
-jest.mock('./components/loading_state', () => ({ LoadingState: 'LoadingState' }));
-jest.mock('./lib/get_indices', () => ({
-  getIndices: () => {
-    return [{ name: 'kibana' }];
-  },
-}));
-const routeComponentPropsMock = {
-  history: {
-    push: jest.fn(),
-  } as any,
-  location: {} as any,
-  match: {} as any,
-};
-const mockContext = mockManagementPlugin.createIndexPatternManagmentContext();
-mockContext.indexPatternManagementStart.creation.getType = () => {
-  return new IndexPatternCreationConfig({
-    type: 'default',
-    name: 'name',
-  });
-};
-
-describe('CreateIndexPatternWizard', () => {
-  test(`defaults to the loading state`, () => {
-    const component = createComponentWithContext(
-      CreateIndexPatternWizard,
-      { ...routeComponentPropsMock },
-      mockContext
-    );
-
-    expect(component).toMatchSnapshot();
-  });
-
-  test('renders the empty state when there are no indices', async () => {
-    const component = createComponentWithContext(
-      CreateIndexPatternWizard,
-      { ...routeComponentPropsMock },
-      mockContext
-    );
-
-    component.setState({
-      isInitiallyLoadingIndices: false,
-      allIndices: [],
-      remoteClustersExist: false,
-    });
-
-    await component.update();
-    expect(component).toMatchSnapshot();
-  });
-
-  test('renders when there are no indices but there are remote clusters', async () => {
-    const component = createComponentWithContext(
-      CreateIndexPatternWizard,
-      { ...routeComponentPropsMock },
-      mockContext
-    );
-
-    component.setState({
-      isInitiallyLoadingIndices: false,
-      allIndices: [],
-      remoteClustersExist: true,
-    });
-
-    await component.update();
-    expect(component).toMatchSnapshot();
-  });
-
-  test('shows system indices even if there are no other indices if the include system indices is toggled', async () => {
-    const component = createComponentWithContext(
-      CreateIndexPatternWizard,
-      { ...routeComponentPropsMock },
-      mockContext
-    );
-
-    component.setState({
-      isInitiallyLoadingIndices: false,
-      isIncludingSystemIndices: true,
-      allIndices: [{ name: '.kibana ' }],
-    });
-
-    await component.update();
-    expect(component).toMatchSnapshot();
-  });
-
-  test('renders index pattern step when there are indices', async () => {
-    const component = createComponentWithContext(
-      CreateIndexPatternWizard,
-      { ...routeComponentPropsMock },
-      mockContext
-    );
-
-    component.setState({
-      isInitiallyLoadingIndices: false,
-      allIndices: [{ name: 'myIndexPattern' }],
-    });
-
-    await component.update();
-    expect(component).toMatchSnapshot();
-  });
-
-  test('renders time field step when step is set to 2', async () => {
-    const component = createComponentWithContext(
-      CreateIndexPatternWizard,
-      { ...routeComponentPropsMock },
-      mockContext
-    );
-
-    component.setState({
-      isInitiallyLoadingIndices: false,
-      allIndices: [{ name: 'myIndexPattern' }],
-      step: 2,
-    });
-
-    await component.update();
-    expect(component).toMatchSnapshot();
-  });
-
-  test('invokes the provided services when creating an index pattern', async () => {
-    const newIndexPatternAndSave = jest.fn().mockImplementation(async () => {
-      return indexPattern;
-    });
-    const clear = jest.fn();
-    mockContext.data.indexPatterns.clearCache = clear;
-    const indexPattern = ({
-      id: '1',
-      title: 'my-fake-index-pattern',
-      timeFieldName: 'timestamp',
-      fields: [],
-      _fetchFields: jest.fn(),
-    } as unknown) as IndexPattern;
-    mockContext.data.indexPatterns.createAndSave = newIndexPatternAndSave;
-    mockContext.data.indexPatterns.setDefault = jest.fn();
-
-    const component = createComponentWithContext(
-      CreateIndexPatternWizard,
-      { ...routeComponentPropsMock },
-      mockContext
-    );
-
-    component.setState({ indexPattern: 'foo' });
-    await (component.instance() as CreateIndexPatternWizard).createIndexPattern(undefined, 'id');
-    expect(newIndexPatternAndSave).toBeCalled();
-    expect(clear).toBeCalledWith('1');
-    expect(routeComponentPropsMock.history.push).toBeCalledWith(`/patterns/1`);
-  });
-});
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/create_index_pattern_wizard.tsx b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/create_index_pattern_wizard.tsx
deleted file mode 100644
index 5bc53105dbcf87..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/create_index_pattern_wizard.tsx
+++ /dev/null
@@ -1,284 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React, { Component, ReactElement } from 'react';
-
-import { EuiGlobalToastList, EuiGlobalToastListToast, EuiSpacer } from '@elastic/eui';
-import { FormattedMessage } from '@kbn/i18n/react';
-import { i18n } from '@kbn/i18n';
-import { RouteComponentProps, withRouter } from 'react-router-dom';
-import { DocLinksStart } from 'src/core/public';
-import { StepIndexPattern } from './components/step_index_pattern';
-import { StepTimeField } from './components/step_time_field';
-import { Header } from './components/header';
-import { LoadingState } from './components/loading_state';
-
-import { context as contextType } from '../../../../kibana_react/public';
-import { getCreateBreadcrumbs } from '../breadcrumbs';
-import { ensureMinimumTime, getIndices } from './lib';
-import { IndexPatternCreationConfig } from '../..';
-import { IndexPatternManagmentContextValue } from '../../types';
-import { MatchedItem } from './types';
-import { DuplicateIndexPatternError, IndexPattern } from '../../../../data/public';
-
-interface CreateIndexPatternWizardState {
-  step: number;
-  indexPattern: string;
-  allIndices: MatchedItem[];
-  remoteClustersExist: boolean;
-  isInitiallyLoadingIndices: boolean;
-  toasts: EuiGlobalToastListToast[];
-  indexPatternCreationType: IndexPatternCreationConfig;
-  selectedTimeField?: string;
-  docLinks: DocLinksStart;
-}
-
-export class CreateIndexPatternWizard extends Component<
-  RouteComponentProps,
-  CreateIndexPatternWizardState
-> {
-  static contextType = contextType;
-
-  public readonly context!: IndexPatternManagmentContextValue;
-
-  constructor(props: RouteComponentProps, context: IndexPatternManagmentContextValue) {
-    super(props, context);
-
-    context.services.setBreadcrumbs(getCreateBreadcrumbs());
-
-    const type = new URLSearchParams(props.location.search).get('type') || undefined;
-    const indexPattern = new URLSearchParams(props.location.search).get('name') || '';
-
-    this.state = {
-      step: 1,
-      indexPattern,
-      allIndices: [],
-      remoteClustersExist: false,
-      isInitiallyLoadingIndices: true,
-      toasts: [],
-      indexPatternCreationType: context.services.indexPatternManagementStart.creation.getType(type),
-      docLinks: context.services.docLinks,
-    };
-  }
-
-  async UNSAFE_componentWillMount() {
-    this.fetchData();
-  }
-
-  catchAndWarn = async (
-    asyncFn: Promise<MatchedItem[]>,
-    errorValue: [] | string[],
-    errorMsg: ReactElement
-  ) => {
-    try {
-      return await asyncFn;
-    } catch (errors) {
-      this.setState((prevState) => ({
-        toasts: prevState.toasts.concat([
-          {
-            title: errorMsg,
-            id: errorMsg.props.id,
-            color: 'warning',
-            iconType: 'alert',
-          },
-        ]),
-      }));
-      return errorValue;
-    }
-  };
-
-  fetchData = async () => {
-    const indicesFailMsg = (
-      <FormattedMessage
-        id="indexPatternManagement.createIndexPattern.loadIndicesFailMsg"
-        defaultMessage="Failed to load indices"
-      />
-    );
-
-    const clustersFailMsg = (
-      <FormattedMessage
-        id="indexPatternManagement.createIndexPattern.loadClustersFailMsg"
-        defaultMessage="Failed to load remote clusters"
-      />
-    );
-
-    // query local and remote indices, updating state independently
-    ensureMinimumTime(
-      this.catchAndWarn(
-        getIndices(
-          this.context.services.http,
-          (indexName: string) => this.state.indexPatternCreationType.getIndexTags(indexName),
-          `*`,
-          false
-        ),
-
-        [],
-        indicesFailMsg
-      )
-    ).then((allIndices: MatchedItem[]) =>
-      this.setState({ allIndices, isInitiallyLoadingIndices: false })
-    );
-
-    this.catchAndWarn(
-      // if we get an error from remote cluster query, supply fallback value that allows user entry.
-      // ['a'] is fallback value
-      getIndices(
-        this.context.services.http,
-        (indexName: string) => this.state.indexPatternCreationType.getIndexTags(indexName),
-        `*:*`,
-        false
-      ),
-
-      ['a'],
-      clustersFailMsg
-    ).then((remoteIndices: string[] | MatchedItem[]) =>
-      this.setState({ remoteClustersExist: !!remoteIndices.length })
-    );
-  };
-
-  createIndexPattern = async (timeFieldName: string | undefined, indexPatternId: string) => {
-    let emptyPattern: IndexPattern;
-    const { history } = this.props;
-    const { indexPattern } = this.state;
-
-    try {
-      emptyPattern = await this.context.services.data.indexPatterns.createAndSave({
-        id: indexPatternId,
-        title: indexPattern,
-        timeFieldName,
-        ...this.state.indexPatternCreationType.getIndexPatternMappings(),
-      });
-    } catch (err) {
-      if (err instanceof DuplicateIndexPatternError) {
-        const confirmMessage = i18n.translate(
-          'indexPatternManagement.indexPattern.titleExistsLabel',
-          {
-            values: { title: emptyPattern!.title },
-            defaultMessage: "An index pattern with the title '{title}' already exists.",
-          }
-        );
-
-        const isConfirmed = await this.context.services.overlays.openConfirm(confirmMessage, {
-          confirmButtonText: i18n.translate(
-            'indexPatternManagement.indexPattern.goToPatternButtonLabel',
-            {
-              defaultMessage: 'Go to existing pattern',
-            }
-          ),
-        });
-
-        if (isConfirmed) {
-          return history.push(`/patterns/${indexPatternId}`);
-        } else {
-          return;
-        }
-      } else {
-        throw err;
-      }
-    }
-
-    await this.context.services.data.indexPatterns.setDefault(emptyPattern.id as string);
-
-    this.context.services.data.indexPatterns.clearCache(emptyPattern.id as string);
-    history.push(`/patterns/${emptyPattern.id}`);
-  };
-
-  goToTimeFieldStep = (indexPattern: string, selectedTimeField?: string) => {
-    this.setState({ step: 2, indexPattern, selectedTimeField });
-  };
-
-  goToIndexPatternStep = () => {
-    this.setState({ step: 1 });
-  };
-
-  renderHeader() {
-    const { docLinks, indexPatternCreationType } = this.state;
-    return (
-      <Header
-        prompt={indexPatternCreationType.renderPrompt()}
-        indexPatternName={indexPatternCreationType.getIndexPatternName()}
-        isBeta={indexPatternCreationType.getIsBeta()}
-        docLinks={docLinks}
-      />
-    );
-  }
-
-  renderContent() {
-    const { allIndices, isInitiallyLoadingIndices, step, indexPattern } = this.state;
-
-    if (isInitiallyLoadingIndices) {
-      return <LoadingState />;
-    }
-
-    const header = this.renderHeader();
-
-    if (step === 1) {
-      const { location } = this.props;
-      const initialQuery = new URLSearchParams(location.search).get('id') || undefined;
-
-      return (
-        <>
-          {header}
-          <EuiSpacer size={'l'} />
-          <StepIndexPattern
-            allIndices={allIndices}
-            initialQuery={indexPattern || initialQuery}
-            indexPatternCreationType={this.state.indexPatternCreationType}
-            goToNextStep={this.goToTimeFieldStep}
-            showSystemIndices={
-              this.state.indexPatternCreationType.getShowSystemIndices() && this.state.step === 1
-            }
-          />
-        </>
-      );
-    }
-
-    if (step === 2) {
-      return (
-        <>
-          {header}
-          <EuiSpacer size={'l'} />
-          <StepTimeField
-            indexPattern={indexPattern}
-            goToPreviousStep={this.goToIndexPatternStep}
-            createIndexPattern={this.createIndexPattern}
-            indexPatternCreationType={this.state.indexPatternCreationType}
-            selectedTimeField={this.state.selectedTimeField}
-          />
-        </>
-      );
-    }
-
-    return null;
-  }
-
-  removeToast = (id: string) => {
-    this.setState((prevState) => ({
-      toasts: prevState.toasts.filter((toast) => toast.id !== id),
-    }));
-  };
-
-  render() {
-    const content = this.renderContent();
-
-    return (
-      <>
-        {content}
-        <EuiGlobalToastList
-          toasts={this.state.toasts}
-          dismissToast={({ id }) => {
-            this.removeToast(id);
-          }}
-          toastLifeTimeMs={6000}
-        />
-      </>
-    );
-  }
-}
-
-export const CreateIndexPatternWizardWithRouter = withRouter(CreateIndexPatternWizard);
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/index.ts b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/index.ts
deleted file mode 100644
index 52087f388cb971..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/index.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-export { CreateIndexPatternWizardWithRouter } from './create_index_pattern_wizard';
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/extract_time_fields.ts b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/extract_time_fields.ts
deleted file mode 100644
index e2af9339e57a35..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/lib/extract_time_fields.ts
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { i18n } from '@kbn/i18n';
-import { IndexPatternField } from '../../../../../../plugins/data/public';
-
-export function extractTimeFields(fields: IndexPatternField[]) {
-  const dateFields = fields.filter((field) => field.type === 'date');
-  const label = i18n.translate(
-    'indexPatternManagement.createIndexPattern.stepTime.noTimeFieldsLabel',
-    {
-      defaultMessage: "The indices which match this index pattern don't contain any time fields.",
-    }
-  );
-
-  if (dateFields.length === 0) {
-    return [
-      {
-        display: label,
-      },
-    ];
-  }
-
-  const disabledDividerOption = {
-    isDisabled: true,
-    display: '───',
-    fieldName: '',
-  };
-  const noTimeFieldLabel = i18n.translate(
-    'indexPatternManagement.createIndexPattern.stepTime.noTimeFieldOptionLabel',
-    {
-      defaultMessage: "I don't want to use the time filter",
-    }
-  );
-  const noTimeFieldOption = {
-    display: noTimeFieldLabel,
-    fieldName: undefined,
-  };
-
-  return [
-    ...dateFields.map((field) => ({
-      display: field.name,
-      fieldName: field.name,
-    })),
-    disabledDividerOption,
-    noTimeFieldOption,
-  ];
-}
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/types.ts b/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/types.ts
deleted file mode 100644
index 8d511a30c35326..00000000000000
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/types.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-export interface MatchedItem {
-  name: string;
-  tags: Tag[];
-  item: {
-    name: string;
-    backing_indices?: string[];
-    timestamp_field?: string;
-    indices?: string[];
-    aliases?: string[];
-    attributes?: ResolveIndexResponseItemIndexAttrs[];
-    data_stream?: string;
-  };
-}
-
-export interface ResolveIndexResponse {
-  indices?: ResolveIndexResponseItemIndex[];
-  aliases?: ResolveIndexResponseItemAlias[];
-  data_streams?: ResolveIndexResponseItemDataStream[];
-}
-
-export interface ResolveIndexResponseItem {
-  name: string;
-}
-
-export interface ResolveIndexResponseItemDataStream extends ResolveIndexResponseItem {
-  backing_indices: string[];
-  timestamp_field: string;
-}
-
-export interface ResolveIndexResponseItemAlias extends ResolveIndexResponseItem {
-  indices: string[];
-}
-
-export interface ResolveIndexResponseItemIndex extends ResolveIndexResponseItem {
-  aliases?: string[];
-  attributes?: ResolveIndexResponseItemIndexAttrs[];
-  data_stream?: string;
-}
-
-export enum ResolveIndexResponseItemIndexAttrs {
-  OPEN = 'open',
-  CLOSED = 'closed',
-  HIDDEN = 'hidden',
-  FROZEN = 'frozen',
-}
-
-export interface Tag {
-  name: string;
-  key: string;
-  color: string;
-}
diff --git a/src/plugins/index_pattern_management/public/components/edit_index_pattern/edit_index_pattern.tsx b/src/plugins/index_pattern_management/public/components/edit_index_pattern/edit_index_pattern.tsx
index 6609605da87d19..a8f89b471e4eb6 100644
--- a/src/plugins/index_pattern_management/public/components/edit_index_pattern/edit_index_pattern.tsx
+++ b/src/plugins/index_pattern_management/public/components/edit_index_pattern/edit_index_pattern.tsx
@@ -25,6 +25,7 @@ import { useKibana } from '../../../../../plugins/kibana_react/public';
 import { IndexPatternManagmentContext } from '../../types';
 import { Tabs } from './tabs';
 import { IndexHeader } from './index_header';
+import { getTags } from '../utils';
 
 export interface EditIndexPatternProps extends RouteComponentProps {
   indexPattern: IndexPattern;
@@ -57,7 +58,6 @@ export const EditIndexPattern = withRouter(
   ({ indexPattern, history, location }: EditIndexPatternProps) => {
     const {
       uiSettings,
-      indexPatternManagementStart,
       overlays,
       chrome,
       data,
@@ -77,13 +77,8 @@ export const EditIndexPattern = withRouter(
     }, [indexPattern]);
 
     useEffect(() => {
-      const indexPatternTags =
-        indexPatternManagementStart.list.getIndexPatternTags(
-          indexPattern,
-          indexPattern.id === defaultIndex
-        ) || [];
-      setTags(indexPatternTags);
-    }, [defaultIndex, indexPattern, indexPatternManagementStart.list]);
+      setTags(getTags(indexPattern, indexPattern.id === defaultIndex));
+    }, [defaultIndex, indexPattern]);
 
     const setDefaultPattern = useCallback(() => {
       uiSettings.set('defaultIndex', indexPattern.id);
diff --git a/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.test.tsx b/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.test.tsx
index 6d37e8f13d6b39..2f288dc0729148 100644
--- a/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.test.tsx
+++ b/src/plugins/index_pattern_management/public/components/edit_index_pattern/indexed_fields_table/indexed_fields_table.test.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 import { shallow } from 'enzyme';
 import { IndexPatternField, IndexPattern, IndexPatternType } from 'src/plugins/data/public';
 import { IndexedFieldsTable } from './indexed_fields_table';
-import { RollupIndexPatternListConfig } from '../../../service/list';
+import { getFieldInfo } from '../../utils';
 
 jest.mock('@elastic/eui', () => ({
   EuiFlexGroup: 'eui-flex-group',
@@ -30,7 +30,7 @@ const helpers = {
   editField: (fieldName: string) => {},
   deleteField: (fieldName: string) => {},
   // getFieldInfo handles non rollups as well
-  getFieldInfo: new RollupIndexPatternListConfig().getFieldInfo,
+  getFieldInfo,
 };
 
 const indexPattern = ({
diff --git a/src/plugins/index_pattern_management/public/components/edit_index_pattern/tabs/tabs.tsx b/src/plugins/index_pattern_management/public/components/edit_index_pattern/tabs/tabs.tsx
index 4d99bd504cd0fe..6594d677884c2d 100644
--- a/src/plugins/index_pattern_management/public/components/edit_index_pattern/tabs/tabs.tsx
+++ b/src/plugins/index_pattern_management/public/components/edit_index_pattern/tabs/tabs.tsx
@@ -35,6 +35,7 @@ import { SourceFiltersTable } from '../source_filters_table';
 import { IndexedFieldsTable } from '../indexed_fields_table';
 import { ScriptedFieldsTable } from '../scripted_fields_table';
 import { getTabs, getPath, convertToEuiSelectOption } from './utils';
+import { getFieldInfo } from '../../utils';
 
 interface TabsProps extends Pick<RouteComponentProps, 'history' | 'location'> {
   indexPattern: IndexPattern;
@@ -81,7 +82,6 @@ export function Tabs({
 }: TabsProps) {
   const {
     uiSettings,
-    indexPatternManagementStart,
     docLinks,
     indexPatternFieldEditor,
   } = useKibana<IndexPatternManagmentContext>().services;
@@ -227,7 +227,7 @@ export function Tabs({
                     helpers={{
                       editField: openFieldEditor,
                       deleteField,
-                      getFieldInfo: indexPatternManagementStart.list.getFieldInfo,
+                      getFieldInfo,
                     }}
                   />
                 )}
@@ -280,7 +280,6 @@ export function Tabs({
       getFilterSection,
       history,
       indexPattern,
-      indexPatternManagementStart.list.getFieldInfo,
       indexedFieldTypeFilter,
       refreshFilters,
       scriptedFieldLanguageFilter,
@@ -293,15 +292,13 @@ export function Tabs({
 
   const euiTabs: EuiTabbedContentTab[] = useMemo(
     () =>
-      getTabs(indexPattern, fieldFilter, indexPatternManagementStart.list).map(
-        (tab: Pick<EuiTabbedContentTab, 'name' | 'id'>) => {
-          return {
-            ...tab,
-            content: getContent(tab.id),
-          };
-        }
-      ),
-    [fieldFilter, getContent, indexPattern, indexPatternManagementStart.list]
+      getTabs(indexPattern, fieldFilter).map((tab: Pick<EuiTabbedContentTab, 'name' | 'id'>) => {
+        return {
+          ...tab,
+          content: getContent(tab.id),
+        };
+      }),
+    [fieldFilter, getContent, indexPattern]
   );
 
   const [selectedTabId, setSelectedTabId] = useState(euiTabs[0].id);
diff --git a/src/plugins/index_pattern_management/public/components/edit_index_pattern/tabs/utils.ts b/src/plugins/index_pattern_management/public/components/edit_index_pattern/tabs/utils.ts
index afa786b4d71e6b..76bb86eb88d9b7 100644
--- a/src/plugins/index_pattern_management/public/components/edit_index_pattern/tabs/utils.ts
+++ b/src/plugins/index_pattern_management/public/components/edit_index_pattern/tabs/utils.ts
@@ -9,8 +9,8 @@
 import { Dictionary, countBy, defaults, uniq } from 'lodash';
 import { i18n } from '@kbn/i18n';
 import { IndexPattern, IndexPatternField } from '../../../../../../plugins/data/public';
-import { IndexPatternManagementStart } from '../../../../../../plugins/index_pattern_management/public';
 import { TAB_INDEXED_FIELDS, TAB_SCRIPTED_FIELDS, TAB_SOURCE_FILTERS } from '../constants';
+import { areScriptedFieldsEnabled } from '../../utils';
 
 function filterByName(items: IndexPatternField[], filter: string) {
   const lowercaseFilter = (filter || '').toLowerCase();
@@ -68,11 +68,7 @@ function getTitle(type: string, filteredCount: Dictionary<number>, totalCount: D
   return title + count;
 }
 
-export function getTabs(
-  indexPattern: IndexPattern,
-  fieldFilter: string,
-  indexPatternListProvider: IndexPatternManagementStart['list']
-) {
+export function getTabs(indexPattern: IndexPattern, fieldFilter: string) {
   const totalCount = getCounts(indexPattern.fields.getAll(), indexPattern.getSourceFiltering());
   const filteredCount = getCounts(
     indexPattern.fields.getAll(),
@@ -88,7 +84,7 @@ export function getTabs(
     'data-test-subj': 'tab-indexedFields',
   });
 
-  if (indexPatternListProvider.areScriptedFieldsEnabled(indexPattern)) {
+  if (areScriptedFieldsEnabled(indexPattern)) {
     tabs.push({
       name: getTitle('scripted', filteredCount, totalCount),
       id: TAB_SCRIPTED_FIELDS,
diff --git a/src/plugins/index_pattern_management/public/components/field_editor/components/field_format_editor/field_format_editor.test.tsx b/src/plugins/index_pattern_management/public/components/field_editor/components/field_format_editor/field_format_editor.test.tsx
index c2f0c7cbfd64c6..1a06fdf4255006 100644
--- a/src/plugins/index_pattern_management/public/components/field_editor/components/field_format_editor/field_format_editor.test.tsx
+++ b/src/plugins/index_pattern_management/public/components/field_editor/components/field_format_editor/field_format_editor.test.tsx
@@ -10,7 +10,7 @@ import React, { PureComponent } from 'react';
 import { shallow } from 'enzyme';
 
 import { FieldFormatEditor } from './field_format_editor';
-import type { FieldFormat } from '../../../../../../data/public';
+import type { FieldFormat } from '../../../../../../field_formats/common';
 
 class TestEditor extends PureComponent {
   render() {
diff --git a/src/plugins/index_pattern_management/public/components/field_editor/components/field_format_editor/field_format_editor.tsx b/src/plugins/index_pattern_management/public/components/field_editor/components/field_format_editor/field_format_editor.tsx
index 545a464da0eb31..3689ae70639c88 100644
--- a/src/plugins/index_pattern_management/public/components/field_editor/components/field_format_editor/field_format_editor.tsx
+++ b/src/plugins/index_pattern_management/public/components/field_editor/components/field_format_editor/field_format_editor.tsx
@@ -13,7 +13,7 @@ import type {
   FieldFormatEditorFactory,
   FieldFormatEditor as InnerFieldFormatEditor,
 } from 'src/plugins/index_pattern_field_editor/public';
-import type { FieldFormat } from 'src/plugins/data/public';
+import type { FieldFormat } from 'src/plugins/field_formats/common';
 
 export interface FieldFormatEditorProps {
   fieldType: string;
diff --git a/src/plugins/index_pattern_management/public/components/field_editor/components/scripting_call_outs/__snapshots__/warning_call_out.test.tsx.snap b/src/plugins/index_pattern_management/public/components/field_editor/components/scripting_call_outs/__snapshots__/warning_call_out.test.tsx.snap
index ba0f2aee0565f8..5d417dadca923b 100644
--- a/src/plugins/index_pattern_management/public/components/field_editor/components/scripting_call_outs/__snapshots__/warning_call_out.test.tsx.snap
+++ b/src/plugins/index_pattern_management/public/components/field_editor/components/scripting_call_outs/__snapshots__/warning_call_out.test.tsx.snap
@@ -152,6 +152,7 @@ exports[`ScriptingWarningCallOut should render normally 1`] = `
           >
             <div
               className="euiTextColor euiTextColor--default"
+              style={Object {}}
             >
               <EuiText
                 size="s"
diff --git a/src/plugins/index_pattern_management/public/components/field_editor/field_editor.test.tsx b/src/plugins/index_pattern_management/public/components/field_editor/field_editor.test.tsx
index ae3783ecfec092..18c749d448da8e 100644
--- a/src/plugins/index_pattern_management/public/components/field_editor/field_editor.test.tsx
+++ b/src/plugins/index_pattern_management/public/components/field_editor/field_editor.test.tsx
@@ -6,12 +6,8 @@
  * Side Public License, v 1.
  */
 
-import {
-  IndexPattern,
-  IndexPatternField,
-  FieldFormatInstanceType,
-  IndexPatternsService,
-} from 'src/plugins/data/public';
+import { IndexPattern, IndexPatternField, IndexPatternsService } from 'src/plugins/data/public';
+import { FieldFormatInstanceType } from 'src/plugins/field_formats/common';
 import { findTestSubject } from '@elastic/eui/lib/test';
 
 jest.mock('brace/mode/groovy', () => ({}));
diff --git a/src/plugins/index_pattern_management/public/components/field_editor/field_editor.tsx b/src/plugins/index_pattern_management/public/components/field_editor/field_editor.tsx
index b5c0186cd998ce..bdc18938f9d6cd 100644
--- a/src/plugins/index_pattern_management/public/components/field_editor/field_editor.tsx
+++ b/src/plugins/index_pattern_management/public/components/field_editor/field_editor.tsx
@@ -33,13 +33,13 @@ import {
 
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
+import type { FieldFormatInstanceType } from 'src/plugins/field_formats/common';
 import {
   getEnabledScriptingLanguages,
   getDeprecatedScriptingLanguages,
   getSupportedScriptingLanguages,
 } from '../../scripting_languages';
 import {
-  FieldFormatInstanceType,
   IndexPattern,
   IndexPatternField,
   KBN_FIELD_TYPES,
diff --git a/src/plugins/index_pattern_management/public/components/index.ts b/src/plugins/index_pattern_management/public/components/index.ts
index 022f32fb3defcf..bbe10af809c9ff 100644
--- a/src/plugins/index_pattern_management/public/components/index.ts
+++ b/src/plugins/index_pattern_management/public/components/index.ts
@@ -13,4 +13,3 @@ export {
   CreateEditField,
   CreateEditFieldContainer,
 } from './edit_index_pattern';
-export { CreateIndexPatternWizardWithRouter } from './create_index_pattern_wizard';
diff --git a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_state/index.ts b/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_state/index.ts
deleted file mode 100644
index 4e19a60d5a769e..00000000000000
--- a/src/plugins/index_pattern_management/public/components/index_pattern_table/empty_state/index.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-export { EmptyState } from './empty_state';
diff --git a/src/plugins/index_pattern_management/public/components/index_pattern_table/index_pattern_table.tsx b/src/plugins/index_pattern_management/public/components/index_pattern_table/index_pattern_table.tsx
index 6405a81282471e..ef99be4df7cb81 100644
--- a/src/plugins/index_pattern_management/public/components/index_pattern_table/index_pattern_table.tsx
+++ b/src/plugins/index_pattern_management/public/components/index_pattern_table/index_pattern_table.tsx
@@ -8,6 +8,7 @@
 
 import {
   EuiBadge,
+  EuiButton,
   EuiBadgeGroup,
   EuiButtonEmpty,
   EuiInMemoryTable,
@@ -15,19 +16,14 @@ import {
   EuiSpacer,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { RouteComponentProps, withRouter } from 'react-router-dom';
+import { RouteComponentProps, withRouter, useLocation } from 'react-router-dom';
 import React, { useEffect, useState } from 'react';
 import { i18n } from '@kbn/i18n';
 import { reactRouterNavigate, useKibana } from '../../../../../plugins/kibana_react/public';
 import { IndexPatternManagmentContext } from '../../types';
-import { CreateButton } from '../create_button';
-import { IndexPatternCreationOption, IndexPatternTableItem } from '../types';
+import { IndexPatternTableItem } from '../types';
 import { getIndexPatterns } from '../utils';
 import { getListBreadcrumbs } from '../breadcrumbs';
-import { EmptyState } from './empty_state';
-import { MatchedItem, ResolveIndexResponseItemAlias } from '../create_index_pattern_wizard/types';
-import { EmptyIndexPatternPrompt } from './empty_index_pattern_prompt';
-import { getIndices } from '../create_index_pattern_wizard/lib';
 
 const pagination = {
   initialPageSize: 10,
@@ -56,67 +52,45 @@ const title = i18n.translate('indexPatternManagement.indexPatternTable.title', {
 
 interface Props extends RouteComponentProps {
   canSave: boolean;
+  showCreateDialog?: boolean;
 }
 
-export const IndexPatternTable = ({ canSave, history }: Props) => {
+export const IndexPatternTable = ({
+  history,
+  canSave,
+  showCreateDialog: showCreateDialogProp = false,
+}: Props) => {
   const {
     setBreadcrumbs,
     uiSettings,
     indexPatternManagementStart,
     chrome,
-    docLinks,
-    application,
-    http,
     data,
+    IndexPatternEditor,
   } = useKibana<IndexPatternManagmentContext>().services;
   const [indexPatterns, setIndexPatterns] = useState<IndexPatternTableItem[]>([]);
-  const [creationOptions, setCreationOptions] = useState<IndexPatternCreationOption[]>([]);
-  const [sources, setSources] = useState<MatchedItem[]>([]);
-  const [remoteClustersExist, setRemoteClustersExist] = useState<boolean>(false);
-  const [isLoadingSources, setIsLoadingSources] = useState<boolean>(true);
   const [isLoadingIndexPatterns, setIsLoadingIndexPatterns] = useState<boolean>(true);
+  const [showCreateDialog, setShowCreateDialog] = useState<boolean>(showCreateDialogProp);
 
   setBreadcrumbs(getListBreadcrumbs());
   useEffect(() => {
     (async function () {
-      const options = await indexPatternManagementStart.creation.getIndexPatternCreationOptions(
-        history.push
-      );
       const gettedIndexPatterns: IndexPatternTableItem[] = await getIndexPatterns(
         uiSettings.get('defaultIndex'),
-        indexPatternManagementStart,
         data.indexPatterns
       );
-      setIsLoadingIndexPatterns(false);
-      setCreationOptions(options);
       setIndexPatterns(gettedIndexPatterns);
+      setIsLoadingIndexPatterns(false);
+      if (gettedIndexPatterns.length === 0) {
+        setShowCreateDialog(true);
+      }
     })();
-  }, [history.push, indexPatterns.length, indexPatternManagementStart, uiSettings, data]);
-
-  const removeAliases = (item: MatchedItem) =>
-    !((item as unknown) as ResolveIndexResponseItemAlias).indices;
-
-  const loadSources = () => {
-    getIndices(http, () => [], '*', false).then((dataSources) =>
-      setSources(dataSources.filter(removeAliases))
-    );
-    getIndices(http, () => [], '*:*', false).then((dataSources) =>
-      setRemoteClustersExist(!!dataSources.filter(removeAliases).length)
-    );
-  };
-
-  useEffect(() => {
-    getIndices(http, () => [], '*', false).then((dataSources) => {
-      setSources(dataSources.filter(removeAliases));
-      setIsLoadingSources(false);
-    });
-    getIndices(http, () => [], '*:*', false).then((dataSources) =>
-      setRemoteClustersExist(!!dataSources.filter(removeAliases).length)
-    );
-  }, [http, creationOptions]);
+  }, [indexPatternManagementStart, uiSettings, data]);
 
   chrome.docTitle.change(title);
 
+  const isRollup = new URLSearchParams(useLocation().search).get('type') === 'rollup';
+
   const columns = [
     {
       field: 'title',
@@ -150,43 +124,36 @@ export const IndexPatternTable = ({ canSave, history }: Props) => {
   ];
 
   const createButton = canSave ? (
-    <CreateButton options={creationOptions}>
+    <EuiButton
+      fill={true}
+      iconType="plusInCircle"
+      onClick={() => setShowCreateDialog(true)}
+      data-test-subj="createIndexPatternButton"
+    >
       <FormattedMessage
         id="indexPatternManagement.indexPatternTable.createBtn"
         defaultMessage="Create index pattern"
       />
-    </CreateButton>
+    </EuiButton>
   ) : (
     <></>
   );
 
-  if (isLoadingSources || isLoadingIndexPatterns) {
+  if (isLoadingIndexPatterns) {
     return <></>;
   }
 
-  const hasDataIndices = sources.some(({ name }: MatchedItem) => !name.startsWith('.'));
-
-  if (!indexPatterns.length) {
-    if (!hasDataIndices && !remoteClustersExist) {
-      return (
-        <EmptyState
-          onRefresh={loadSources}
-          docLinks={docLinks}
-          navigateToApp={application.navigateToApp}
-          canSave={canSave}
-        />
-      );
-    } else {
-      return (
-        <EmptyIndexPatternPrompt
-          canSave={canSave}
-          creationOptions={creationOptions}
-          docLinksIndexPatternIntro={docLinks.links.indexPatterns.introduction}
-          setBreadcrumbs={setBreadcrumbs}
-        />
-      );
-    }
-  }
+  const displayIndexPatternEditor = showCreateDialog ? (
+    <IndexPatternEditor
+      onSave={(indexPattern) => {
+        history.push(`patterns/${indexPattern.id}`);
+      }}
+      onCancel={() => setShowCreateDialog(false)}
+      defaultTypeIsRollup={isRollup}
+    />
+  ) : (
+    <></>
+  );
 
   return (
     <div data-test-subj="indexPatternTable" role="region" aria-label={title}>
@@ -214,6 +181,7 @@ export const IndexPatternTable = ({ canSave, history }: Props) => {
         sorting={sorting}
         search={search}
       />
+      {displayIndexPatternEditor}
     </div>
   );
 };
diff --git a/src/plugins/index_pattern_management/public/components/utils.test.ts b/src/plugins/index_pattern_management/public/components/utils.test.ts
index 15e0a65390f4d3..6215a8dd15c4cd 100644
--- a/src/plugins/index_pattern_management/public/components/utils.test.ts
+++ b/src/plugins/index_pattern_management/public/components/utils.test.ts
@@ -7,7 +7,6 @@
  */
 import { IndexPatternsContract } from 'src/plugins/data/public';
 import { getIndexPatterns } from './utils';
-import { mockManagementPlugin } from '../mocks';
 
 const indexPatternContractMock = ({
   getIdsWithTitle: jest.fn().mockReturnValue(
@@ -25,13 +24,7 @@ const indexPatternContractMock = ({
   get: jest.fn().mockReturnValue(Promise.resolve({})),
 } as unknown) as jest.Mocked<IndexPatternsContract>;
 
-const mockManagementPluginStart = mockManagementPlugin.createStartContract();
-
 test('getting index patterns', async () => {
-  const indexPatterns = await getIndexPatterns(
-    'test',
-    mockManagementPluginStart,
-    indexPatternContractMock
-  );
+  const indexPatterns = await getIndexPatterns('test', indexPatternContractMock);
   expect(indexPatterns).toMatchSnapshot();
 });
diff --git a/src/plugins/index_pattern_management/public/components/utils.ts b/src/plugins/index_pattern_management/public/components/utils.ts
index 68e78199798b4e..6520de95028c6b 100644
--- a/src/plugins/index_pattern_management/public/components/utils.ts
+++ b/src/plugins/index_pattern_management/public/components/utils.ts
@@ -7,11 +7,29 @@
  */
 
 import { IndexPatternsContract } from 'src/plugins/data/public';
-import { IndexPatternManagementStart } from '../plugin';
+import { IndexPattern, IFieldType } from 'src/plugins/data/public';
+import { i18n } from '@kbn/i18n';
+
+const defaultIndexPatternListName = i18n.translate(
+  'indexPatternManagement.editIndexPattern.list.defaultIndexPatternListName',
+  {
+    defaultMessage: 'Default',
+  }
+);
+
+const rollupIndexPatternListName = i18n.translate(
+  'indexPatternManagement.editIndexPattern.list.rollupIndexPatternListName',
+  {
+    defaultMessage: 'Rollup',
+  }
+);
+
+const isRollup = (indexPattern: IndexPattern) => {
+  return indexPattern.type === 'rollup';
+};
 
 export async function getIndexPatterns(
   defaultIndex: string,
-  indexPatternManagementStart: IndexPatternManagementStart,
   indexPatternsService: IndexPatternsContract
 ) {
   const existingIndexPatterns = await indexPatternsService.getIdsWithTitle(true);
@@ -19,10 +37,7 @@ export async function getIndexPatterns(
     existingIndexPatterns.map(async ({ id, title }) => {
       const isDefault = defaultIndex === id;
       const pattern = await indexPatternsService.get(id);
-      const tags = (indexPatternManagementStart as IndexPatternManagementStart).list.getIndexPatternTags(
-        pattern,
-        isDefault
-      );
+      const tags = getTags(pattern, isDefault);
 
       return {
         id,
@@ -49,3 +64,78 @@ export async function getIndexPatterns(
     }) || []
   );
 }
+
+export const getTags = (indexPattern: IndexPattern, isDefault: boolean) => {
+  const tags = [];
+  if (isDefault) {
+    tags.push({
+      key: 'default',
+      name: defaultIndexPatternListName,
+    });
+  }
+  if (isRollup(indexPattern)) {
+    tags.push({
+      key: 'rollup',
+      name: rollupIndexPatternListName,
+    });
+  }
+  return tags;
+};
+
+export const areScriptedFieldsEnabled = (indexPattern: IndexPattern) => {
+  return !isRollup(indexPattern);
+};
+
+export const getFieldInfo = (indexPattern: IndexPattern, field: IFieldType) => {
+  if (!isRollup(indexPattern)) {
+    return [];
+  }
+
+  const allAggs = indexPattern.typeMeta && indexPattern.typeMeta.aggs;
+  const fieldAggs = allAggs && Object.keys(allAggs).filter((agg) => allAggs[agg][field.name]);
+
+  if (!fieldAggs || !fieldAggs.length) {
+    return [];
+  }
+
+  return ['Rollup aggregations:'].concat(
+    fieldAggs.map((aggName) => {
+      const agg = allAggs![aggName][field.name];
+      switch (aggName) {
+        case 'date_histogram':
+          return i18n.translate(
+            'indexPatternManagement.editIndexPattern.list.dateHistogramSummary',
+            {
+              defaultMessage: '{aggName} (interval: {interval}, {delay} {time_zone})',
+              values: {
+                aggName,
+                interval: agg.fixed_interval,
+                delay: agg.delay
+                  ? i18n.translate(
+                      'indexPatternManagement.editIndexPattern.list.DateHistogramDelaySummary',
+                      {
+                        defaultMessage: 'delay: {delay},',
+                        values: {
+                          delay: agg.delay,
+                        },
+                      }
+                    )
+                  : '',
+                time_zone: agg.time_zone,
+              },
+            }
+          );
+        case 'histogram':
+          return i18n.translate('indexPatternManagement.editIndexPattern.list.histogramSummary', {
+            defaultMessage: '{aggName} (interval: {interval})',
+            values: {
+              aggName,
+              interval: agg.interval,
+            },
+          });
+        default:
+          return aggName;
+      }
+    })
+  );
+};
diff --git a/src/plugins/index_pattern_management/public/index.ts b/src/plugins/index_pattern_management/public/index.ts
index 726c055d1b8c34..45a2f0b5a468b4 100644
--- a/src/plugins/index_pattern_management/public/index.ts
+++ b/src/plugins/index_pattern_management/public/index.ts
@@ -24,9 +24,3 @@ export { IndexPatternManagementSetup, IndexPatternManagementStart } from './plug
 export function plugin(initializerContext: PluginInitializerContext) {
   return new IndexPatternManagementPlugin(initializerContext);
 }
-
-export {
-  IndexPatternCreationConfig,
-  IndexPatternCreationOption,
-  IndexPatternListConfig,
-} from './service';
diff --git a/src/plugins/index_pattern_management/public/management_app/mount_management_section.tsx b/src/plugins/index_pattern_management/public/management_app/mount_management_section.tsx
index ec5b7c74020a5a..e493595c848cff 100644
--- a/src/plugins/index_pattern_management/public/management_app/mount_management_section.tsx
+++ b/src/plugins/index_pattern_management/public/management_app/mount_management_section.tsx
@@ -20,7 +20,6 @@ import {
   IndexPatternTableWithRouter,
   EditIndexPatternContainer,
   CreateEditFieldContainer,
-  CreateIndexPatternWizardWithRouter,
 } from '../components';
 import { IndexPatternManagementStartDependencies, IndexPatternManagementStart } from '../plugin';
 import { IndexPatternManagmentContext } from '../types';
@@ -41,7 +40,7 @@ export async function mountManagementSection(
 ) {
   const [
     { chrome, application, uiSettings, notifications, overlays, http, docLinks },
-    { data, indexPatternFieldEditor },
+    { data, indexPatternFieldEditor, indexPatternEditor },
     indexPatternManagementStart,
   ] = await getStartServices();
   const canSave = Boolean(application.capabilities.indexPatterns.save);
@@ -63,6 +62,7 @@ export async function mountManagementSection(
     indexPatternManagementStart: indexPatternManagementStart as IndexPatternManagementStart,
     setBreadcrumbs: params.setBreadcrumbs,
     fieldFormatEditors: indexPatternFieldEditor.fieldFormatEditors,
+    IndexPatternEditor: indexPatternEditor.IndexPatternEditorComponent,
   };
 
   ReactDOM.render(
@@ -71,7 +71,7 @@ export async function mountManagementSection(
         <Router history={params.history}>
           <Switch>
             <Route path={['/create']}>
-              <CreateIndexPatternWizardWithRouter />
+              <IndexPatternTableWithRouter canSave={canSave} showCreateDialog={true} />
             </Route>
             <Route path={['/patterns/:id/field/:fieldName', '/patterns/:id/create-field/']}>
               <CreateEditFieldContainer />
diff --git a/src/plugins/index_pattern_management/public/mocks.ts b/src/plugins/index_pattern_management/public/mocks.ts
index 7671a532d1cb86..5bcca1f09029ff 100644
--- a/src/plugins/index_pattern_management/public/mocks.ts
+++ b/src/plugins/index_pattern_management/public/mocks.ts
@@ -12,6 +12,7 @@ import { managementPluginMock } from '../../management/public/mocks';
 import { urlForwardingPluginMock } from '../../url_forwarding/public/mocks';
 import { dataPluginMock } from '../../data/public/mocks';
 import { indexPatternFieldEditorPluginMock } from '../../index_pattern_field_editor/public/mocks';
+import { indexPatternEditorPluginMock } from '../../index_pattern_editor/public/mocks';
 import {
   IndexPatternManagementSetup,
   IndexPatternManagementStart,
@@ -19,19 +20,9 @@ import {
 } from './plugin';
 import { IndexPatternManagmentContext } from './types';
 
-const createSetupContract = (): IndexPatternManagementSetup => {};
+const createSetupContract = (): IndexPatternManagementSetup => ({});
 
-const createStartContract = (): IndexPatternManagementStart => ({
-  creation: {
-    getType: jest.fn(),
-    getIndexPatternCreationOptions: jest.fn(),
-  } as any,
-  list: {
-    getIndexPatternTags: jest.fn(),
-    getFieldInfo: jest.fn(),
-    areScriptedFieldsEnabled: jest.fn(),
-  } as any,
-});
+const createStartContract = (): IndexPatternManagementStart => ({});
 
 const createInstance = async () => {
   const plugin = new IndexPatternManagementPlugin({} as PluginInitializerContext);
@@ -40,11 +31,7 @@ const createInstance = async () => {
     management: managementPluginMock.createSetupContract(),
     urlForwarding: urlForwardingPluginMock.createSetupContract(),
   });
-  const doStart = () =>
-    plugin.start(coreMock.createStart(), {
-      data: dataPluginMock.createStartContract(),
-      indexPatternFieldEditor: indexPatternFieldEditorPluginMock.createStartContract(),
-    });
+  const doStart = () => plugin.start();
 
   return {
     plugin,
@@ -84,6 +71,8 @@ const createIndexPatternManagmentContext = (): {
     indexPatternManagementStart: createStartContract(),
     setBreadcrumbs: () => {},
     fieldFormatEditors: indexPatternFieldEditor.fieldFormatEditors,
+    IndexPatternEditor: indexPatternEditorPluginMock.createStartContract()
+      .IndexPatternEditorComponent,
   };
 };
 
diff --git a/src/plugins/index_pattern_management/public/plugin.ts b/src/plugins/index_pattern_management/public/plugin.ts
index d254691a0270da..9527a04a6b0e25 100644
--- a/src/plugins/index_pattern_management/public/plugin.ts
+++ b/src/plugins/index_pattern_management/public/plugin.ts
@@ -7,17 +7,13 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { PluginInitializerContext, CoreSetup, CoreStart, Plugin } from 'src/core/public';
+import { PluginInitializerContext, CoreSetup, Plugin } from 'src/core/public';
 import { DataPublicPluginStart } from 'src/plugins/data/public';
 import { UrlForwardingSetup } from '../../url_forwarding/public';
-import {
-  IndexPatternManagementService,
-  IndexPatternManagementServiceSetup,
-  IndexPatternManagementServiceStart,
-} from './service';
 
 import { ManagementSetup } from '../../management/public';
 import { IndexPatternFieldEditorStart } from '../../index_pattern_field_editor/public';
+import { IndexPatternEditorStart } from '../../index_pattern_editor/public';
 
 export interface IndexPatternManagementSetupDependencies {
   management: ManagementSetup;
@@ -27,11 +23,14 @@ export interface IndexPatternManagementSetupDependencies {
 export interface IndexPatternManagementStartDependencies {
   data: DataPublicPluginStart;
   indexPatternFieldEditor: IndexPatternFieldEditorStart;
+  indexPatternEditor: IndexPatternEditorStart;
 }
 
-export type IndexPatternManagementSetup = IndexPatternManagementServiceSetup;
+// eslint-disable-next-line @typescript-eslint/no-empty-interface
+export interface IndexPatternManagementSetup {}
 
-export type IndexPatternManagementStart = IndexPatternManagementServiceStart;
+// eslint-disable-next-line @typescript-eslint/no-empty-interface
+export interface IndexPatternManagementStart {}
 
 const sectionsHeader = i18n.translate('indexPatternManagement.indexPattern.sectionsHeader', {
   defaultMessage: 'Index Patterns',
@@ -47,8 +46,6 @@ export class IndexPatternManagementPlugin
       IndexPatternManagementSetupDependencies,
       IndexPatternManagementStartDependencies
     > {
-  private readonly indexPatternManagementService = new IndexPatternManagementService();
-
   constructor(initializerContext: PluginInitializerContext) {}
 
   public setup(
@@ -80,16 +77,12 @@ export class IndexPatternManagementPlugin
         return mountManagementSection(core.getStartServices, params);
       },
     });
+    return {};
   }
 
-  public start(core: CoreStart, plugins: IndexPatternManagementStartDependencies) {
-    return this.indexPatternManagementService.start({
-      httpClient: core.http,
-      uiSettings: core.uiSettings,
-    });
+  public start() {
+    return {};
   }
 
-  public stop() {
-    this.indexPatternManagementService.stop();
-  }
+  public stop() {}
 }
diff --git a/src/plugins/index_pattern_management/public/service/creation/components/rollup_prompt/index.ts b/src/plugins/index_pattern_management/public/service/creation/components/rollup_prompt/index.ts
deleted file mode 100644
index d1fc2fa242eb1b..00000000000000
--- a/src/plugins/index_pattern_management/public/service/creation/components/rollup_prompt/index.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-export { RollupPrompt } from './rollup_prompt';
diff --git a/src/plugins/index_pattern_management/public/service/creation/components/rollup_prompt/rollup_prompt.tsx b/src/plugins/index_pattern_management/public/service/creation/components/rollup_prompt/rollup_prompt.tsx
deleted file mode 100644
index 81fcdaedb90c90..00000000000000
--- a/src/plugins/index_pattern_management/public/service/creation/components/rollup_prompt/rollup_prompt.tsx
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-import { i18n } from '@kbn/i18n';
-
-import { EuiCallOut } from '@elastic/eui';
-
-export const RollupPrompt = () => (
-  <EuiCallOut color="warning" iconType="help" title="Beta feature">
-    <p>
-      {i18n.translate(
-        'indexPatternManagement.editRollupIndexPattern.rollupPrompt.betaCalloutParagraph1Text',
-        {
-          defaultMessage:
-            "Kibana's support for rollup index patterns is in beta. You might encounter issues using " +
-            'these patterns in saved searches, visualizations, and dashboards. They are not supported in ' +
-            'some advanced features, such as Timelion, and Machine Learning.',
-        }
-      )}
-    </p>
-    <p>
-      {i18n.translate(
-        'indexPatternManagement.editRollupIndexPattern.rollupPrompt.betaCalloutParagraph2Text',
-        {
-          defaultMessage:
-            'You can match a rollup index pattern against one rollup index and zero or more regular ' +
-            'indices. A rollup index pattern has limited metrics, fields, intervals, and aggregations. A ' +
-            'rollup index is limited to indices that have one job configuration, or multiple jobs with ' +
-            'compatible configurations.',
-        }
-      )}
-    </p>
-  </EuiCallOut>
-);
diff --git a/src/plugins/index_pattern_management/public/service/creation/config.ts b/src/plugins/index_pattern_management/public/service/creation/config.ts
deleted file mode 100644
index 6d7e3aa9e5ede8..00000000000000
--- a/src/plugins/index_pattern_management/public/service/creation/config.ts
+++ /dev/null
@@ -1,112 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { i18n } from '@kbn/i18n';
-import { MatchedItem } from '../../components/create_index_pattern_wizard/types';
-
-const indexPatternTypeName = i18n.translate(
-  'indexPatternManagement.editIndexPattern.createIndex.defaultTypeName',
-  { defaultMessage: 'index pattern' }
-);
-
-const indexPatternButtonText = i18n.translate(
-  'indexPatternManagement.editIndexPattern.createIndex.defaultButtonText',
-  { defaultMessage: 'Standard index pattern' }
-);
-
-const indexPatternButtonDescription = i18n.translate(
-  'indexPatternManagement.editIndexPattern.createIndex.defaultButtonDescription',
-  { defaultMessage: 'Perform full aggregations against any data' }
-);
-
-export type UrlHandler = (url: string) => void;
-
-export interface IndexPatternCreationOption {
-  text: string;
-  description: string;
-  testSubj: string;
-  onClick: () => void;
-  isBeta?: boolean;
-}
-
-export class IndexPatternCreationConfig {
-  public readonly key = 'default';
-
-  protected type?: string;
-  protected name: string;
-  protected showSystemIndices: boolean;
-  protected httpClient: object | null;
-  protected isBeta: boolean;
-
-  constructor({
-    type = undefined,
-    name = indexPatternTypeName,
-    showSystemIndices = true,
-    httpClient = null,
-    isBeta = false,
-  }: {
-    type?: string;
-    name?: string;
-    showSystemIndices?: boolean;
-    httpClient?: object | null;
-    isBeta?: boolean;
-  }) {
-    this.type = type;
-    this.name = name;
-    this.showSystemIndices = showSystemIndices;
-    this.httpClient = httpClient;
-    this.isBeta = isBeta;
-  }
-
-  public getIndexPatternCreationOption(urlHandler: UrlHandler): IndexPatternCreationOption {
-    return {
-      text: indexPatternButtonText,
-      description: indexPatternButtonDescription,
-      testSubj: `createStandardIndexPatternButton`,
-      onClick: () => {
-        urlHandler('/create');
-      },
-    };
-  }
-
-  public getIndexPatternType() {
-    return this.type;
-  }
-
-  public getIndexPatternName() {
-    return this.name;
-  }
-
-  public getIsBeta() {
-    return this.isBeta;
-  }
-
-  public getShowSystemIndices() {
-    return this.showSystemIndices;
-  }
-
-  public getIndexTags(indexName: string) {
-    return [];
-  }
-
-  public checkIndicesForErrors(indices: MatchedItem[]) {
-    return undefined;
-  }
-
-  public getIndexPatternMappings() {
-    return {};
-  }
-
-  public renderPrompt() {
-    return null;
-  }
-
-  public getFetchForWildcardOptions() {
-    return {};
-  }
-}
diff --git a/src/plugins/index_pattern_management/public/service/creation/index.ts b/src/plugins/index_pattern_management/public/service/creation/index.ts
deleted file mode 100644
index e1f464b01e5505..00000000000000
--- a/src/plugins/index_pattern_management/public/service/creation/index.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-export { IndexPatternCreationConfig, IndexPatternCreationOption } from './config';
-export { IndexPatternCreationManager } from './manager';
-// @ts-ignore
-export { RollupIndexPatternCreationConfig } from './rollup_creation_config';
diff --git a/src/plugins/index_pattern_management/public/service/creation/manager.ts b/src/plugins/index_pattern_management/public/service/creation/manager.ts
deleted file mode 100644
index cc2285bbfcafb3..00000000000000
--- a/src/plugins/index_pattern_management/public/service/creation/manager.ts
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { once } from 'lodash';
-import { HttpStart, CoreStart } from '../../../../../core/public';
-import { IndexPatternCreationConfig, UrlHandler, IndexPatternCreationOption } from './config';
-import { CONFIG_ROLLUPS } from '../../constants';
-// @ts-ignore
-import { RollupIndexPatternCreationConfig } from './rollup_creation_config';
-
-interface IndexPatternCreationManagerStart {
-  httpClient: HttpStart;
-  uiSettings: CoreStart['uiSettings'];
-}
-
-export class IndexPatternCreationManager {
-  start({ httpClient, uiSettings }: IndexPatternCreationManagerStart) {
-    const getConfigs = once(() => {
-      const configs: IndexPatternCreationConfig[] = [];
-      configs.push(new IndexPatternCreationConfig({ httpClient }));
-
-      if (uiSettings.isDeclared(CONFIG_ROLLUPS) && uiSettings.get(CONFIG_ROLLUPS)) {
-        configs.push(new RollupIndexPatternCreationConfig({ httpClient }));
-      }
-
-      return configs;
-    });
-
-    const getType = (key: string | undefined): IndexPatternCreationConfig => {
-      const configs = getConfigs();
-      if (key) {
-        const index = configs.findIndex((config) => config.key === key);
-        const config = configs[index];
-
-        if (config) {
-          return config;
-        } else {
-          throw new Error(`Index pattern creation type not found: ${key}`);
-        }
-      } else {
-        return getType('default');
-      }
-    };
-
-    return {
-      getType,
-      getIndexPatternCreationOptions: async (urlHandler: UrlHandler) => {
-        const options: IndexPatternCreationOption[] = [];
-
-        await Promise.all(
-          getConfigs().map(async (config) => {
-            const option = config.getIndexPatternCreationOption
-              ? await config.getIndexPatternCreationOption(urlHandler)
-              : null;
-            if (option) {
-              options.push(option);
-            }
-          })
-        );
-
-        return options;
-      },
-    };
-  }
-}
diff --git a/src/plugins/index_pattern_management/public/service/creation/rollup_creation_config.js b/src/plugins/index_pattern_management/public/service/creation/rollup_creation_config.js
deleted file mode 100644
index 2a85dfa01143c7..00000000000000
--- a/src/plugins/index_pattern_management/public/service/creation/rollup_creation_config.js
+++ /dev/null
@@ -1,169 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import React from 'react';
-import { i18n } from '@kbn/i18n';
-
-import { RollupPrompt } from './components/rollup_prompt';
-import { IndexPatternCreationConfig } from '.';
-
-const rollupIndexPatternTypeName = i18n.translate(
-  'indexPatternManagement.editRollupIndexPattern.createIndex.defaultTypeName',
-  { defaultMessage: 'rollup index pattern' }
-);
-
-const rollupIndexPatternButtonText = i18n.translate(
-  'indexPatternManagement.editRollupIndexPattern.createIndex.defaultButtonText',
-  { defaultMessage: 'Rollup index pattern' }
-);
-
-const rollupIndexPatternButtonDescription = i18n.translate(
-  'indexPatternManagement.editRollupIndexPattern.createIndex.defaultButtonDescription',
-  { defaultMessage: 'Perform limited aggregations against summarized data' }
-);
-
-const rollupIndexPatternNoMatchError = i18n.translate(
-  'indexPatternManagement.editRollupIndexPattern.createIndex.noMatchError',
-  { defaultMessage: 'Rollup index pattern error: must match one rollup index' }
-);
-
-const rollupIndexPatternTooManyMatchesError = i18n.translate(
-  'indexPatternManagement.editRollupIndexPattern.createIndex.tooManyMatchesError',
-  { defaultMessage: 'Rollup index pattern error: can only match one rollup index' }
-);
-
-const rollupIndexPatternIndexLabel = i18n.translate(
-  'indexPatternManagement.editRollupIndexPattern.createIndex.indexLabel',
-  { defaultMessage: 'Rollup' }
-);
-
-export class RollupIndexPatternCreationConfig extends IndexPatternCreationConfig {
-  key = 'rollup';
-
-  constructor(options) {
-    super({
-      type: 'rollup',
-      name: rollupIndexPatternTypeName,
-      showSystemIndices: false,
-      isBeta: true,
-      ...options,
-    });
-
-    this.rollupIndex = null;
-    this.rollupJobs = [];
-    this.rollupIndicesCapabilities = {};
-    this.rollupIndices = [];
-  }
-
-  async setRollupIndices() {
-    try {
-      // This is a hack intended to prevent the getRollupIndices() request from being sent if
-      // we're on /logout. There is a race condition that can arise on that page, whereby this
-      // request resolves after the logout request resolves, and un-clears the session ID.
-      const isAnonymous = this.httpClient.anonymousPaths.isAnonymous(window.location.pathname);
-      if (!isAnonymous) {
-        const response = await this.httpClient.get('/api/rollup/indices');
-        this.rollupIndicesCapabilities = response || {};
-      }
-
-      this.rollupIndices = Object.keys(this.rollupIndicesCapabilities);
-    } catch (e) {
-      // Silently swallow failure responses such as expired trials
-    }
-  }
-
-  async getIndexPatternCreationOption(urlHandler) {
-    await this.setRollupIndices();
-    return this.rollupIndices && this.rollupIndices.length
-      ? {
-          text: rollupIndexPatternButtonText,
-          description: rollupIndexPatternButtonDescription,
-          testSubj: `createRollupIndexPatternButton`,
-          isBeta: this.isBeta,
-          onClick: () => {
-            urlHandler('/create?type=rollup');
-          },
-        }
-      : null;
-  }
-
-  isRollupIndex = (indexName) => {
-    return this.rollupIndices.includes(indexName);
-  };
-
-  getIndexTags(indexName) {
-    return this.isRollupIndex(indexName)
-      ? [
-          {
-            key: this.type,
-            name: rollupIndexPatternIndexLabel,
-            color: 'primary',
-          },
-        ]
-      : [];
-  }
-
-  checkIndicesForErrors = (indices) => {
-    this.rollupIndex = null;
-
-    if (!indices || !indices.length) {
-      return;
-    }
-
-    const rollupIndices = indices.filter((index) => this.isRollupIndex(index.name));
-
-    if (!rollupIndices.length) {
-      return [rollupIndexPatternNoMatchError];
-    } else if (rollupIndices.length > 1) {
-      return [rollupIndexPatternTooManyMatchesError];
-    }
-
-    const rollupIndexName = rollupIndices[0].name;
-    const error = this.rollupIndicesCapabilities[rollupIndexName].error;
-
-    if (error) {
-      const errorMessage = i18n.translate(
-        'indexPatternManagement.editRollupIndexPattern.createIndex.uncaughtError',
-        {
-          defaultMessage: 'Rollup index pattern error: {error}',
-          values: {
-            error,
-          },
-        }
-      );
-      return [errorMessage];
-    }
-
-    this.rollupIndex = rollupIndexName;
-  };
-
-  getIndexPatternMappings = () => {
-    return this.rollupIndex
-      ? {
-          type: this.type,
-          typeMeta: {
-            params: {
-              rollup_index: this.rollupIndex,
-            },
-            aggs: this.rollupIndicesCapabilities[this.rollupIndex].aggs,
-          },
-        }
-      : {};
-  };
-
-  renderPrompt = () => {
-    return <RollupPrompt />;
-  };
-
-  getFetchForWildcardOptions = () => {
-    return {
-      type: this.type,
-      rollupIndex: this.rollupIndex,
-    };
-  };
-}
diff --git a/src/plugins/index_pattern_management/public/service/index.ts b/src/plugins/index_pattern_management/public/service/index.ts
deleted file mode 100644
index 8bf09cf544648d..00000000000000
--- a/src/plugins/index_pattern_management/public/service/index.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-export * from './index_pattern_management_service';
-export { IndexPatternCreationConfig, IndexPatternCreationOption } from './creation';
-export { IndexPatternListConfig } from './list';
diff --git a/src/plugins/index_pattern_management/public/service/index_pattern_management_service.ts b/src/plugins/index_pattern_management/public/service/index_pattern_management_service.ts
deleted file mode 100644
index 25a36faa1c3e37..00000000000000
--- a/src/plugins/index_pattern_management/public/service/index_pattern_management_service.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { HttpStart, CoreStart } from '../../../../core/public';
-import { IndexPatternCreationManager } from './creation';
-import { IndexPatternListManager } from './list';
-
-interface StartDependencies {
-  httpClient: HttpStart;
-  uiSettings: CoreStart['uiSettings'];
-}
-
-/**
- * Index patterns management service
- *
- * @internal
- */
-export class IndexPatternManagementService {
-  indexPatternCreationManager: IndexPatternCreationManager;
-  indexPatternListConfig: IndexPatternListManager;
-
-  constructor() {
-    this.indexPatternCreationManager = new IndexPatternCreationManager();
-    this.indexPatternListConfig = new IndexPatternListManager();
-  }
-
-  public setup() {}
-
-  public start({ httpClient, uiSettings }: StartDependencies) {
-    return {
-      creation: this.indexPatternCreationManager.start({ httpClient, uiSettings }),
-      list: this.indexPatternListConfig.start({ uiSettings }),
-    };
-  }
-
-  public stop() {
-    // nothing to do here yet.
-  }
-}
-
-/** @internal */
-export type IndexPatternManagementServiceSetup = ReturnType<IndexPatternManagementService['setup']>;
-export type IndexPatternManagementServiceStart = ReturnType<IndexPatternManagementService['start']>;
diff --git a/src/plugins/index_pattern_management/public/service/list/config.ts b/src/plugins/index_pattern_management/public/service/list/config.ts
deleted file mode 100644
index 4be27fc47d0db8..00000000000000
--- a/src/plugins/index_pattern_management/public/service/list/config.ts
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { i18n } from '@kbn/i18n';
-import { IndexPattern, IndexPatternField, IndexPatternType } from '../../../../data/public';
-
-export interface IndexPatternTag {
-  key: string;
-  name: string;
-}
-
-const defaultIndexPatternListName = i18n.translate(
-  'indexPatternManagement.editIndexPattern.list.defaultIndexPatternListName',
-  {
-    defaultMessage: 'Default',
-  }
-);
-
-export class IndexPatternListConfig {
-  public readonly key: IndexPatternType = IndexPatternType.DEFAULT;
-
-  public getIndexPatternTags(indexPattern: IndexPattern, isDefault: boolean): IndexPatternTag[] {
-    return isDefault
-      ? [
-          {
-            key: 'default',
-            name: defaultIndexPatternListName,
-          },
-        ]
-      : [];
-  }
-
-  public getFieldInfo(indexPattern: IndexPattern, field: IndexPatternField): string[] {
-    return [];
-  }
-
-  public areScriptedFieldsEnabled(indexPattern: IndexPattern): boolean {
-    return true;
-  }
-}
diff --git a/src/plugins/index_pattern_management/public/service/list/index.ts b/src/plugins/index_pattern_management/public/service/list/index.ts
deleted file mode 100644
index 738b807ac76246..00000000000000
--- a/src/plugins/index_pattern_management/public/service/list/index.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-export { IndexPatternListConfig } from './config';
-export { IndexPatternListManager } from './manager';
-// @ts-ignore
-export { RollupIndexPatternListConfig } from './rollup_list_config';
diff --git a/src/plugins/index_pattern_management/public/service/list/manager.ts b/src/plugins/index_pattern_management/public/service/list/manager.ts
deleted file mode 100644
index d9cefbd8001a5d..00000000000000
--- a/src/plugins/index_pattern_management/public/service/list/manager.ts
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { IndexPattern, IndexPatternField } from 'src/plugins/data/public';
-import { once } from 'lodash';
-import { CoreStart } from '../../../../../core/public';
-import { IndexPatternListConfig, IndexPatternTag } from './config';
-import { CONFIG_ROLLUPS } from '../../constants';
-import { RollupIndexPatternListConfig } from './rollup_list_config';
-
-interface IndexPatternListManagerStart {
-  uiSettings: CoreStart['uiSettings'];
-}
-
-export class IndexPatternListManager {
-  start({ uiSettings }: IndexPatternListManagerStart) {
-    const getConfigs = once(() => {
-      const configs: IndexPatternListConfig[] = [];
-      configs.push(new IndexPatternListConfig());
-
-      if (uiSettings.isDeclared(CONFIG_ROLLUPS) && uiSettings.get(CONFIG_ROLLUPS)) {
-        configs.push(new RollupIndexPatternListConfig());
-      }
-
-      return configs;
-    });
-    return {
-      getIndexPatternTags: (indexPattern: IndexPattern, isDefault: boolean) =>
-        getConfigs().reduce(
-          (tags: IndexPatternTag[], config) =>
-            config.getIndexPatternTags
-              ? tags.concat(config.getIndexPatternTags(indexPattern, isDefault))
-              : tags,
-          []
-        ),
-
-      getFieldInfo: (indexPattern: IndexPattern, field: IndexPatternField): string[] =>
-        getConfigs().reduce(
-          (info: string[], config) =>
-            config.getFieldInfo ? info.concat(config.getFieldInfo(indexPattern, field)) : info,
-          []
-        ),
-
-      areScriptedFieldsEnabled: (indexPattern: IndexPattern): boolean =>
-        getConfigs().every((config) =>
-          config.areScriptedFieldsEnabled ? config.areScriptedFieldsEnabled(indexPattern) : true
-        ),
-    };
-  }
-}
diff --git a/src/plugins/index_pattern_management/public/service/list/rollup_list_config.ts b/src/plugins/index_pattern_management/public/service/list/rollup_list_config.ts
deleted file mode 100644
index bb9da0d461701d..00000000000000
--- a/src/plugins/index_pattern_management/public/service/list/rollup_list_config.ts
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { IndexPattern, IndexPatternField, IndexPatternType } from '../../../../data/public';
-import { IndexPatternListConfig } from '.';
-
-function isRollup(indexPattern: IndexPattern) {
-  return indexPattern.type === IndexPatternType.ROLLUP;
-}
-
-export class RollupIndexPatternListConfig extends IndexPatternListConfig {
-  key = IndexPatternType.ROLLUP;
-
-  getIndexPatternTags = (indexPattern: IndexPattern) => {
-    return isRollup(indexPattern)
-      ? [
-          {
-            key: 'rollup',
-            name: 'Rollup',
-          },
-        ]
-      : [];
-  };
-
-  getFieldInfo = (indexPattern: IndexPattern, field: IndexPatternField) => {
-    if (!isRollup(indexPattern)) {
-      return [];
-    }
-
-    const allAggs = indexPattern.typeMeta && indexPattern.typeMeta.aggs;
-    const fieldAggs = allAggs && Object.keys(allAggs).filter((agg) => allAggs[agg][field.name]);
-
-    if (!fieldAggs || !fieldAggs.length) {
-      return [];
-    }
-
-    return ['Rollup aggregations:'].concat(
-      fieldAggs.map((aggName) => {
-        const agg = allAggs![aggName][field.name];
-        switch (aggName) {
-          case 'date_histogram':
-            return `${aggName} (interval: ${agg.fixed_interval}, ${
-              agg.delay ? `delay: ${agg.delay},` : ''
-            } ${agg.time_zone})`;
-          case 'histogram':
-            return `${aggName} (interval: ${agg.interval})`;
-          default:
-            return aggName;
-        }
-      })
-    );
-  };
-
-  areScriptedFieldsEnabled = (indexPattern: IndexPattern) => {
-    return !isRollup(indexPattern);
-  };
-}
diff --git a/src/plugins/index_pattern_management/public/types.ts b/src/plugins/index_pattern_management/public/types.ts
index a61eeb99b25a57..b2c77fccf90b90 100644
--- a/src/plugins/index_pattern_management/public/types.ts
+++ b/src/plugins/index_pattern_management/public/types.ts
@@ -20,6 +20,7 @@ import { ManagementAppMountParams } from '../../management/public';
 import { IndexPatternManagementStart } from './index';
 import { KibanaReactContextValue } from '../../kibana_react/public';
 import { IndexPatternFieldEditorStart } from '../../index_pattern_field_editor/public';
+import { IndexPatternEditorStart } from '../../index_pattern_editor/public';
 
 export interface IndexPatternManagmentContext {
   chrome: ChromeStart;
@@ -34,6 +35,7 @@ export interface IndexPatternManagmentContext {
   indexPatternManagementStart: IndexPatternManagementStart;
   setBreadcrumbs: ManagementAppMountParams['setBreadcrumbs'];
   fieldFormatEditors: IndexPatternFieldEditorStart['fieldFormatEditors'];
+  IndexPatternEditor: IndexPatternEditorStart['IndexPatternEditorComponent'];
 }
 
 export type IndexPatternManagmentContextValue = KibanaReactContextValue<IndexPatternManagmentContext>;
diff --git a/src/plugins/index_pattern_management/tsconfig.json b/src/plugins/index_pattern_management/tsconfig.json
index 37bd3e4aa5bbb9..16afcb3599fece 100644
--- a/src/plugins/index_pattern_management/tsconfig.json
+++ b/src/plugins/index_pattern_management/tsconfig.json
@@ -20,5 +20,6 @@
     { "path": "../kibana_utils/tsconfig.json" },
     { "path": "../es_ui_shared/tsconfig.json" },
     { "path": "../index_pattern_field_editor/tsconfig.json" },
+    { "path": "../index_pattern_editor/tsconfig.json" },
   ]
 }
diff --git a/src/plugins/kibana_react/public/code_editor/languages/index.ts b/src/plugins/kibana_react/public/code_editor/languages/index.ts
index ff7da1725fa7f9..b797ea44d1f919 100644
--- a/src/plugins/kibana_react/public/code_editor/languages/index.ts
+++ b/src/plugins/kibana_react/public/code_editor/languages/index.ts
@@ -9,5 +9,6 @@
 import { Lang as CssLang } from './css';
 import { Lang as HandlebarsLang } from './handlebars';
 import { Lang as MarkdownLang } from './markdown';
+import { Lang as YamlLang } from './yaml';
 
-export { CssLang, HandlebarsLang, MarkdownLang };
+export { CssLang, HandlebarsLang, MarkdownLang, YamlLang };
diff --git a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/header/index.ts b/src/plugins/kibana_react/public/code_editor/languages/yaml/constants.ts
similarity index 91%
rename from src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/header/index.ts
rename to src/plugins/kibana_react/public/code_editor/languages/yaml/constants.ts
index 8f737b3a42613b..71a34088a216bb 100644
--- a/src/plugins/index_pattern_management/public/components/create_index_pattern_wizard/components/header/index.ts
+++ b/src/plugins/kibana_react/public/code_editor/languages/yaml/constants.ts
@@ -6,4 +6,4 @@
  * Side Public License, v 1.
  */
 
-export { Header } from './header';
+export const LANG = 'yaml';
diff --git a/src/plugins/kibana_react/public/code_editor/languages/yaml/index.ts b/src/plugins/kibana_react/public/code_editor/languages/yaml/index.ts
new file mode 100644
index 00000000000000..f501de74debec9
--- /dev/null
+++ b/src/plugins/kibana_react/public/code_editor/languages/yaml/index.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import { LangModuleType } from '@kbn/monaco';
+import { languageConfiguration, lexerRules } from './language';
+import { LANG } from './constants';
+
+export const Lang: LangModuleType = { ID: LANG, languageConfiguration, lexerRules };
diff --git a/src/plugins/vis_type_timeseries/public/application/visualizations/lib/active_cursor.ts b/src/plugins/kibana_react/public/code_editor/languages/yaml/language.ts
similarity index 64%
rename from src/plugins/vis_type_timeseries/public/application/visualizations/lib/active_cursor.ts
rename to src/plugins/kibana_react/public/code_editor/languages/yaml/language.ts
index 7f7f62fd6a9dab..d17f284b284083 100644
--- a/src/plugins/vis_type_timeseries/public/application/visualizations/lib/active_cursor.ts
+++ b/src/plugins/kibana_react/public/code_editor/languages/yaml/language.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { Subject } from 'rxjs';
-import { PointerEvent } from '@elastic/charts';
+/* eslint-disable @kbn/eslint/module_migration */
+import { conf, language } from 'monaco-editor/esm/vs/basic-languages/yaml/yaml';
 
-export const activeCursor$ = new Subject<PointerEvent>();
+export { conf as languageConfiguration, language as lexerRules };
diff --git a/src/plugins/kibana_react/public/code_editor/register_languages.ts b/src/plugins/kibana_react/public/code_editor/register_languages.ts
index b4a0f4d53cdf47..a32318a7e4b20f 100644
--- a/src/plugins/kibana_react/public/code_editor/register_languages.ts
+++ b/src/plugins/kibana_react/public/code_editor/register_languages.ts
@@ -6,8 +6,9 @@
  * Side Public License, v 1.
  */
 import { registerLanguage } from '@kbn/monaco';
-import { CssLang, HandlebarsLang, MarkdownLang } from './languages';
+import { CssLang, HandlebarsLang, MarkdownLang, YamlLang } from './languages';
 
 registerLanguage(CssLang);
 registerLanguage(HandlebarsLang);
 registerLanguage(MarkdownLang);
+registerLanguage(YamlLang);
diff --git a/src/plugins/kibana_react/public/overview_page/overview_page_footer/overview_page_footer.tsx b/src/plugins/kibana_react/public/overview_page/overview_page_footer/overview_page_footer.tsx
index 09554292072f91..4c96b45353cc91 100644
--- a/src/plugins/kibana_react/public/overview_page/overview_page_footer/overview_page_footer.tsx
+++ b/src/plugins/kibana_react/public/overview_page/overview_page_footer/overview_page_footer.tsx
@@ -50,7 +50,9 @@ export const OverviewPageFooter: FC<Props> = ({
         iconType="home"
         size="xs"
         onClick={(event: MouseEvent) => {
-          application.navigateToUrl(addBasePath('/app/management/kibana/settings#defaultRoute'));
+          application.navigateToUrl(
+            addBasePath('/app/management/kibana/settings?query=default+route')
+          );
           if (onChangeDefaultRoute) {
             onChangeDefaultRoute(event);
           }
diff --git a/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts b/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts
index ace26dc9e62950..57c9893f0cfea0 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts
@@ -428,10 +428,6 @@ export const stackManagementSchema: MakeSchemaFrom<UsageStats> = {
     type: 'boolean',
     _meta: { description: 'Non-default value of setting.' },
   },
-  'apm:enableServiceOverview': {
-    type: 'boolean',
-    _meta: { description: 'Non-default value of setting.' },
-  },
   'observability:enableInspectEsQueries': {
     type: 'boolean',
     _meta: { description: 'Non-default value of setting.' },
diff --git a/src/plugins/kibana_usage_collection/server/collectors/management/types.ts b/src/plugins/kibana_usage_collection/server/collectors/management/types.ts
index 95faaee88fa613..52cf38d32c2e21 100644
--- a/src/plugins/kibana_usage_collection/server/collectors/management/types.ts
+++ b/src/plugins/kibana_usage_collection/server/collectors/management/types.ts
@@ -35,7 +35,6 @@ export interface UsageStats {
   'discover:maxDocFieldsDisplayed': number;
   'securitySolution:rulesTableRefresh': string;
   'apm:enableSignificantTerms': boolean;
-  'apm:enableServiceOverview': boolean;
   'observability:enableInspectEsQueries': boolean;
   'visualize:enableLabs': boolean;
   'visualization:heatmap:maxBuckets': number;
diff --git a/src/plugins/saved_objects_management/public/management_section/object_view/components/__snapshots__/intro.test.tsx.snap b/src/plugins/saved_objects_management/public/management_section/object_view/components/__snapshots__/intro.test.tsx.snap
index 5a8cd06b8ecc07..9c9349b0524c06 100644
--- a/src/plugins/saved_objects_management/public/management_section/object_view/components/__snapshots__/intro.test.tsx.snap
+++ b/src/plugins/saved_objects_management/public/management_section/object_view/components/__snapshots__/intro.test.tsx.snap
@@ -59,6 +59,7 @@ exports[`Intro component renders correctly 1`] = `
           >
             <div
               className="euiTextColor euiTextColor--default"
+              style={Object {}}
             >
               <div>
                 <FormattedMessage
diff --git a/src/plugins/saved_objects_management/public/management_section/object_view/components/__snapshots__/not_found_errors.test.tsx.snap b/src/plugins/saved_objects_management/public/management_section/object_view/components/__snapshots__/not_found_errors.test.tsx.snap
index f977c17df41d31..4227351f8e94d4 100644
--- a/src/plugins/saved_objects_management/public/management_section/object_view/components/__snapshots__/not_found_errors.test.tsx.snap
+++ b/src/plugins/saved_objects_management/public/management_section/object_view/components/__snapshots__/not_found_errors.test.tsx.snap
@@ -61,6 +61,7 @@ exports[`NotFoundErrors component renders correctly for index-pattern type 1`] =
           >
             <div
               className="euiTextColor euiTextColor--default"
+              style={Object {}}
             >
               <div>
                 <FormattedMessage
@@ -150,6 +151,7 @@ exports[`NotFoundErrors component renders correctly for index-pattern-field type
           >
             <div
               className="euiTextColor euiTextColor--default"
+              style={Object {}}
             >
               <div>
                 <FormattedMessage
@@ -239,6 +241,7 @@ exports[`NotFoundErrors component renders correctly for search type 1`] = `
           >
             <div
               className="euiTextColor euiTextColor--default"
+              style={Object {}}
             >
               <div>
                 <FormattedMessage
@@ -328,6 +331,7 @@ exports[`NotFoundErrors component renders correctly for unknown type 1`] = `
           >
             <div
               className="euiTextColor euiTextColor--default"
+              style={Object {}}
             >
               <div />
               <div>
diff --git a/src/plugins/telemetry/common/constants.ts b/src/plugins/telemetry/common/constants.ts
index 8aeb26e8253b66..f6b99badca492c 100644
--- a/src/plugins/telemetry/common/constants.ts
+++ b/src/plugins/telemetry/common/constants.ts
@@ -49,3 +49,17 @@ export const PRIVACY_STATEMENT_URL = `https://www.elastic.co/legal/privacy-state
  * The endpoint version when hitting the remote telemetry service
  */
 export const ENDPOINT_VERSION = 'v2';
+
+/**
+ * The telemetry endpoints for the remote telemetry service.
+ */
+export const TELEMETRY_ENDPOINT = {
+  MAIN_CHANNEL: {
+    PROD: `https://telemetry.elastic.co/xpack/${ENDPOINT_VERSION}/send`,
+    STAGING: `https://telemetry-staging.elastic.co/xpack/${ENDPOINT_VERSION}/send`,
+  },
+  OPT_IN_STATUS_CHANNEL: {
+    PROD: `https://telemetry.elastic.co/opt_in_status/${ENDPOINT_VERSION}/send`,
+    STAGING: `https://telemetry-staging.elastic.co/opt_in_status/${ENDPOINT_VERSION}/send`,
+  },
+};
diff --git a/src/plugins/telemetry/common/telemetry_config/get_telemetry_channel_endpoint.test.ts b/src/plugins/telemetry/common/telemetry_config/get_telemetry_channel_endpoint.test.ts
new file mode 100644
index 00000000000000..74d45f6a9f7d40
--- /dev/null
+++ b/src/plugins/telemetry/common/telemetry_config/get_telemetry_channel_endpoint.test.ts
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { getTelemetryChannelEndpoint } from './get_telemetry_channel_endpoint';
+import { TELEMETRY_ENDPOINT } from '../constants';
+
+describe('getTelemetryChannelEndpoint', () => {
+  it('throws on unknown env', () => {
+    expect(() =>
+      // @ts-expect-error
+      getTelemetryChannelEndpoint({ env: 'ANY', channelName: 'main' })
+    ).toThrowErrorMatchingInlineSnapshot(`"Unknown telemetry endpoint env ANY."`);
+  });
+
+  it('throws on unknown channelName', () => {
+    expect(() =>
+      // @ts-expect-error
+      getTelemetryChannelEndpoint({ env: 'prod', channelName: 'ANY' })
+    ).toThrowErrorMatchingInlineSnapshot(`"Unknown telemetry channel ANY."`);
+  });
+
+  describe('main channel', () => {
+    it('returns correct prod endpoint', () => {
+      const endpoint = getTelemetryChannelEndpoint({ env: 'prod', channelName: 'main' });
+      expect(endpoint).toBe(TELEMETRY_ENDPOINT.MAIN_CHANNEL.PROD);
+    });
+    it('returns correct staging endpoint', () => {
+      const endpoint = getTelemetryChannelEndpoint({ env: 'staging', channelName: 'main' });
+      expect(endpoint).toBe(TELEMETRY_ENDPOINT.MAIN_CHANNEL.STAGING);
+    });
+  });
+
+  describe('optInStatus channel', () => {
+    it('returns correct prod endpoint', () => {
+      const endpoint = getTelemetryChannelEndpoint({ env: 'prod', channelName: 'optInStatus' });
+      expect(endpoint).toBe(TELEMETRY_ENDPOINT.OPT_IN_STATUS_CHANNEL.PROD);
+    });
+    it('returns correct staging endpoint', () => {
+      const endpoint = getTelemetryChannelEndpoint({ env: 'staging', channelName: 'optInStatus' });
+      expect(endpoint).toBe(TELEMETRY_ENDPOINT.OPT_IN_STATUS_CHANNEL.STAGING);
+    });
+  });
+});
diff --git a/src/plugins/telemetry/common/telemetry_config/get_telemetry_channel_endpoint.ts b/src/plugins/telemetry/common/telemetry_config/get_telemetry_channel_endpoint.ts
new file mode 100644
index 00000000000000..a0af7878afef64
--- /dev/null
+++ b/src/plugins/telemetry/common/telemetry_config/get_telemetry_channel_endpoint.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { TELEMETRY_ENDPOINT } from '../constants';
+
+export interface GetTelemetryChannelEndpointConfig {
+  channelName: 'main' | 'optInStatus';
+  env: 'staging' | 'prod';
+}
+
+export function getTelemetryChannelEndpoint({
+  channelName,
+  env,
+}: GetTelemetryChannelEndpointConfig): string {
+  if (env !== 'staging' && env !== 'prod') {
+    throw new Error(`Unknown telemetry endpoint env ${env}.`);
+  }
+
+  const endpointEnv = env === 'staging' ? 'STAGING' : 'PROD';
+
+  switch (channelName) {
+    case 'main':
+      return TELEMETRY_ENDPOINT.MAIN_CHANNEL[endpointEnv];
+    case 'optInStatus':
+      return TELEMETRY_ENDPOINT.OPT_IN_STATUS_CHANNEL[endpointEnv];
+    default:
+      throw new Error(`Unknown telemetry channel ${channelName}.`);
+  }
+}
diff --git a/src/plugins/telemetry/common/telemetry_config/index.ts b/src/plugins/telemetry/common/telemetry_config/index.ts
index cc4ff102742d7f..eb268639cad919 100644
--- a/src/plugins/telemetry/common/telemetry_config/index.ts
+++ b/src/plugins/telemetry/common/telemetry_config/index.ts
@@ -11,3 +11,5 @@ export { getTelemetrySendUsageFrom } from './get_telemetry_send_usage_from';
 export { getTelemetryAllowChangingOptInStatus } from './get_telemetry_allow_changing_opt_in_status';
 export { getTelemetryFailureDetails } from './get_telemetry_failure_details';
 export type { TelemetryFailureDetails } from './get_telemetry_failure_details';
+export { getTelemetryChannelEndpoint } from './get_telemetry_channel_endpoint';
+export type { GetTelemetryChannelEndpointConfig } from './get_telemetry_channel_endpoint';
diff --git a/src/plugins/telemetry/public/mocks.ts b/src/plugins/telemetry/public/mocks.ts
index 418aeace77c704..405c6620e802aa 100644
--- a/src/plugins/telemetry/public/mocks.ts
+++ b/src/plugins/telemetry/public/mocks.ts
@@ -34,8 +34,7 @@ export function mockTelemetryService({
 }: TelemetryServiceMockOptions = {}) {
   const config = {
     enabled: true,
-    url: 'http://localhost',
-    optInStatusUrl: 'http://localhost',
+    sendUsageTo: 'staging' as const,
     sendUsageFrom: 'browser' as const,
     optIn: true,
     banner: true,
diff --git a/src/plugins/telemetry/public/plugin.ts b/src/plugins/telemetry/public/plugin.ts
index 04fabe3d62b17c..73dc07d7a4fb93 100644
--- a/src/plugins/telemetry/public/plugin.ts
+++ b/src/plugins/telemetry/public/plugin.ts
@@ -90,16 +90,14 @@ interface TelemetryPluginSetupDependencies {
 export interface TelemetryPluginConfig {
   /** Is the plugin enabled? **/
   enabled: boolean;
-  /** Remote telemetry service's URL **/
-  url: string;
   /** The banner is expected to be shown when needed **/
   banner: boolean;
   /** Does the cluster allow changing the opt-in/out status via the UI? **/
   allowChangingOptInStatus: boolean;
   /** Is the cluster opted-in? **/
   optIn: boolean | null;
-  /** Opt-in/out notification URL **/
-  optInStatusUrl: string;
+  /** Specify if telemetry should send usage to the prod or staging remote telemetry service **/
+  sendUsageTo: 'prod' | 'staging';
   /** Should the telemetry payloads be sent from the server or the browser? **/
   sendUsageFrom: 'browser' | 'server';
   /** Should notify the user about the opt-in status? **/
diff --git a/src/plugins/telemetry/public/services/telemetry_service.test.ts b/src/plugins/telemetry/public/services/telemetry_service.test.ts
index 94630c0cb8d80e..b23ba127c1522c 100644
--- a/src/plugins/telemetry/public/services/telemetry_service.test.ts
+++ b/src/plugins/telemetry/public/services/telemetry_service.test.ts
@@ -10,7 +10,7 @@
 /* eslint-disable dot-notation */
 
 import { mockTelemetryService } from '../mocks';
-
+import { TELEMETRY_ENDPOINT } from '../../common/constants';
 describe('TelemetryService', () => {
   describe('fetchTelemetry', () => {
     it('calls expected URL with 20 minutes - now', async () => {
@@ -137,13 +137,42 @@ describe('TelemetryService', () => {
   });
 
   describe('getTelemetryUrl', () => {
-    it('should return the config.url parameter', async () => {
-      const url = 'http://test.com';
+    it('should return staging endpoint when sendUsageTo is set to staging', async () => {
+      const telemetryService = mockTelemetryService({
+        config: { sendUsageTo: 'staging' },
+      });
+
+      expect(telemetryService.getTelemetryUrl()).toBe(TELEMETRY_ENDPOINT.MAIN_CHANNEL.STAGING);
+    });
+
+    it('should return prod endpoint when sendUsageTo is set to prod', async () => {
+      const telemetryService = mockTelemetryService({
+        config: { sendUsageTo: 'prod' },
+      });
+
+      expect(telemetryService.getTelemetryUrl()).toBe(TELEMETRY_ENDPOINT.MAIN_CHANNEL.PROD);
+    });
+  });
+
+  describe('getOptInStatusUrl', () => {
+    it('should return staging endpoint when sendUsageTo is set to staging', async () => {
+      const telemetryService = mockTelemetryService({
+        config: { sendUsageTo: 'staging' },
+      });
+
+      expect(telemetryService.getOptInStatusUrl()).toBe(
+        TELEMETRY_ENDPOINT.OPT_IN_STATUS_CHANNEL.STAGING
+      );
+    });
+
+    it('should return prod endpoint when sendUsageTo is set to prod', async () => {
       const telemetryService = mockTelemetryService({
-        config: { url },
+        config: { sendUsageTo: 'prod' },
       });
 
-      expect(telemetryService.getTelemetryUrl()).toBe(url);
+      expect(telemetryService.getOptInStatusUrl()).toBe(
+        TELEMETRY_ENDPOINT.OPT_IN_STATUS_CHANNEL.PROD
+      );
     });
   });
 
diff --git a/src/plugins/telemetry/public/services/telemetry_service.ts b/src/plugins/telemetry/public/services/telemetry_service.ts
index 515d2039a4a114..4e52ec3a7e6edf 100644
--- a/src/plugins/telemetry/public/services/telemetry_service.ts
+++ b/src/plugins/telemetry/public/services/telemetry_service.ts
@@ -9,6 +9,7 @@
 import { i18n } from '@kbn/i18n';
 import { CoreStart } from 'kibana/public';
 import { TelemetryPluginConfig } from '../plugin';
+import { getTelemetryChannelEndpoint } from '../../common/telemetry_config';
 
 interface TelemetryServiceConstructor {
   config: TelemetryPluginConfig;
@@ -93,14 +94,14 @@ export class TelemetryService {
 
   /** Retrieve the opt-in/out notification URL **/
   public getOptInStatusUrl = () => {
-    const telemetryOptInStatusUrl = this.config.optInStatusUrl;
-    return telemetryOptInStatusUrl;
+    const { sendUsageTo } = this.config;
+    return getTelemetryChannelEndpoint({ channelName: 'optInStatus', env: sendUsageTo });
   };
 
   /** Retrieve the URL to report telemetry **/
   public getTelemetryUrl = () => {
-    const telemetryUrl = this.config.url;
-    return telemetryUrl;
+    const { sendUsageTo } = this.config;
+    return getTelemetryChannelEndpoint({ channelName: 'main', env: sendUsageTo });
   };
 
   /**
diff --git a/src/plugins/telemetry/schema/oss_plugins.json b/src/plugins/telemetry/schema/oss_plugins.json
index 6947b6cc3ce384..3fceb7913eae64 100644
--- a/src/plugins/telemetry/schema/oss_plugins.json
+++ b/src/plugins/telemetry/schema/oss_plugins.json
@@ -7783,12 +7783,6 @@
             "description": "Non-default value of setting."
           }
         },
-        "apm:enableServiceOverview": {
-          "type": "boolean",
-          "_meta": {
-            "description": "Non-default value of setting."
-          }
-        },
         "observability:enableInspectEsQueries": {
           "type": "boolean",
           "_meta": {
@@ -9336,4 +9330,4 @@
       }
     }
   }
-}
+}
\ No newline at end of file
diff --git a/src/plugins/telemetry/server/config.ts b/src/plugins/telemetry/server/config/config.ts
similarity index 50%
rename from src/plugins/telemetry/server/config.ts
rename to src/plugins/telemetry/server/config/config.ts
index 8123ae4c66e3c5..8d75f0aba1726c 100644
--- a/src/plugins/telemetry/server/config.ts
+++ b/src/plugins/telemetry/server/config/config.ts
@@ -6,11 +6,18 @@
  * Side Public License, v 1.
  */
 
-import { schema, TypeOf } from '@kbn/config-schema';
+import { schema, TypeOf, Type } from '@kbn/config-schema';
 import { getConfigPath } from '@kbn/utils';
-import { ENDPOINT_VERSION } from '../common/constants';
+import { PluginConfigDescriptor } from 'kibana/server';
+import { TELEMETRY_ENDPOINT } from '../../common/constants';
+import { deprecateEndpointConfigs } from './deprecations';
 
-export const configSchema = schema.object({
+const clusterEnvSchema: [Type<'prod'>, Type<'staging'>] = [
+  schema.literal('prod'),
+  schema.literal('staging'),
+];
+
+const configSchema = schema.object({
   enabled: schema.boolean({ defaultValue: true }),
   allowChangingOptInStatus: schema.boolean({ defaultValue: true }),
   optIn: schema.conditional(
@@ -23,24 +30,38 @@ export const configSchema = schema.object({
   // `config` is used internally and not intended to be set
   config: schema.string({ defaultValue: getConfigPath() }),
   banner: schema.boolean({ defaultValue: true }),
+  sendUsageTo: schema.conditional(
+    schema.contextRef('dist'),
+    schema.literal(false), // Point to staging if it's not a distributable release
+    schema.oneOf(clusterEnvSchema, { defaultValue: 'staging' }),
+    schema.oneOf(clusterEnvSchema, { defaultValue: 'prod' })
+  ),
+  /**
+   * REMOVE IN 8.0 - INTERNAL CONFIG DEPRECATED IN 7.15
+   * REPLACED WITH `telemetry.sendUsageTo: staging | prod`
+   */
   url: schema.conditional(
     schema.contextRef('dist'),
     schema.literal(false), // Point to staging if it's not a distributable release
     schema.string({
-      defaultValue: `https://telemetry-staging.elastic.co/xpack/${ENDPOINT_VERSION}/send`,
+      defaultValue: TELEMETRY_ENDPOINT.MAIN_CHANNEL.STAGING,
     }),
     schema.string({
-      defaultValue: `https://telemetry.elastic.co/xpack/${ENDPOINT_VERSION}/send`,
+      defaultValue: TELEMETRY_ENDPOINT.MAIN_CHANNEL.PROD,
     })
   ),
+  /**
+   * REMOVE IN 8.0 - INTERNAL CONFIG DEPRECATED IN 7.15
+   * REPLACED WITH `telemetry.sendUsageTo: staging | prod`
+   */
   optInStatusUrl: schema.conditional(
     schema.contextRef('dist'),
     schema.literal(false), // Point to staging if it's not a distributable release
     schema.string({
-      defaultValue: `https://telemetry-staging.elastic.co/opt_in_status/${ENDPOINT_VERSION}/send`,
+      defaultValue: TELEMETRY_ENDPOINT.OPT_IN_STATUS_CHANNEL.STAGING,
     }),
     schema.string({
-      defaultValue: `https://telemetry.elastic.co/opt_in_status/${ENDPOINT_VERSION}/send`,
+      defaultValue: TELEMETRY_ENDPOINT.OPT_IN_STATUS_CHANNEL.PROD,
     })
   ),
   sendUsageFrom: schema.oneOf([schema.literal('server'), schema.literal('browser')], {
@@ -49,3 +70,16 @@ export const configSchema = schema.object({
 });
 
 export type TelemetryConfigType = TypeOf<typeof configSchema>;
+
+export const config: PluginConfigDescriptor<TelemetryConfigType> = {
+  schema: configSchema,
+  exposeToBrowser: {
+    enabled: true,
+    banner: true,
+    allowChangingOptInStatus: true,
+    optIn: true,
+    sendUsageFrom: true,
+    sendUsageTo: true,
+  },
+  deprecations: () => [deprecateEndpointConfigs],
+};
diff --git a/src/plugins/telemetry/server/config/deprecations.test.ts b/src/plugins/telemetry/server/config/deprecations.test.ts
new file mode 100644
index 00000000000000..0823b521b23a7f
--- /dev/null
+++ b/src/plugins/telemetry/server/config/deprecations.test.ts
@@ -0,0 +1,164 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { deprecateEndpointConfigs } from './deprecations';
+import type { TelemetryConfigType } from './config';
+import { TELEMETRY_ENDPOINT } from '../../common/constants';
+describe('deprecateEndpointConfigs', () => {
+  const fromPath = 'telemetry';
+  const mockAddDeprecation = jest.fn();
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  function createMockRawConfig(telemetryConfig?: Partial<TelemetryConfigType>) {
+    return {
+      elasticsearch: { username: 'kibana_system', password: 'changeme' },
+      plugins: { paths: [] },
+      server: { port: 5603, basePath: '/hln', rewriteBasePath: true },
+      logging: { json: false },
+      ...(telemetryConfig ? { telemetry: telemetryConfig } : {}),
+    };
+  }
+
+  it('returns void if telemetry.* config is not set', () => {
+    const rawConfig = createMockRawConfig();
+    const result = deprecateEndpointConfigs(rawConfig, fromPath, mockAddDeprecation);
+    expect(result).toBe(undefined);
+  });
+
+  it('sets "telemetryConfig.sendUsageTo: staging" if "telemetry.url" uses the staging endpoint', () => {
+    const rawConfig = createMockRawConfig({
+      url: TELEMETRY_ENDPOINT.MAIN_CHANNEL.STAGING,
+    });
+    const result = deprecateEndpointConfigs(rawConfig, fromPath, mockAddDeprecation);
+    expect(result).toMatchInlineSnapshot(`
+      Object {
+        "set": Array [
+          Object {
+            "path": "telemetry.sendUsageTo",
+            "value": "staging",
+          },
+        ],
+        "unset": Array [
+          Object {
+            "path": "telemetry.url",
+          },
+        ],
+      }
+    `);
+  });
+
+  it('sets "telemetryConfig.sendUsageTo: prod" if "telemetry.url" uses the non-staging endpoint', () => {
+    const rawConfig = createMockRawConfig({
+      url: 'random-endpoint',
+    });
+    const result = deprecateEndpointConfigs(rawConfig, fromPath, mockAddDeprecation);
+    expect(result).toMatchInlineSnapshot(`
+      Object {
+        "set": Array [
+          Object {
+            "path": "telemetry.sendUsageTo",
+            "value": "prod",
+          },
+        ],
+        "unset": Array [
+          Object {
+            "path": "telemetry.url",
+          },
+        ],
+      }
+    `);
+  });
+
+  it('sets "telemetryConfig.sendUsageTo: staging" if "telemetry.optInStatusUrl" uses the staging endpoint', () => {
+    const rawConfig = createMockRawConfig({
+      optInStatusUrl: TELEMETRY_ENDPOINT.MAIN_CHANNEL.STAGING,
+    });
+    const result = deprecateEndpointConfigs(rawConfig, fromPath, mockAddDeprecation);
+    expect(result).toMatchInlineSnapshot(`
+      Object {
+        "set": Array [
+          Object {
+            "path": "telemetry.sendUsageTo",
+            "value": "staging",
+          },
+        ],
+        "unset": Array [
+          Object {
+            "path": "telemetry.optInStatusUrl",
+          },
+        ],
+      }
+    `);
+  });
+
+  it('sets "telemetryConfig.sendUsageTo: prod" if "telemetry.optInStatusUrl" uses the non-staging endpoint', () => {
+    const rawConfig = createMockRawConfig({
+      optInStatusUrl: 'random-endpoint',
+    });
+    const result = deprecateEndpointConfigs(rawConfig, fromPath, mockAddDeprecation);
+    expect(result).toMatchInlineSnapshot(`
+      Object {
+        "set": Array [
+          Object {
+            "path": "telemetry.sendUsageTo",
+            "value": "prod",
+          },
+        ],
+        "unset": Array [
+          Object {
+            "path": "telemetry.optInStatusUrl",
+          },
+        ],
+      }
+    `);
+  });
+
+  it('registers deprecation when "telemetry.url" is set', () => {
+    const rawConfig = createMockRawConfig({
+      url: TELEMETRY_ENDPOINT.MAIN_CHANNEL.PROD,
+    });
+    deprecateEndpointConfigs(rawConfig, fromPath, mockAddDeprecation);
+    expect(mockAddDeprecation).toBeCalledTimes(1);
+    expect(mockAddDeprecation.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "correctiveActions": Object {
+            "manualSteps": Array [
+              "Remove \\"telemetry.url\\" from the Kibana configuration.",
+              "To send usage to the staging endpoint add \\"telemetry.sendUsageTo: staging\\" to the Kibana configuration.",
+            ],
+          },
+          "message": "\\"telemetry.url\\" has been deprecated. Set \\"telemetry.sendUsageTo: staging\\" to the Kibana configurations to send usage to the staging endpoint.",
+        },
+      ]
+    `);
+  });
+
+  it('registers deprecation when "telemetry.optInStatusUrl" is set', () => {
+    const rawConfig = createMockRawConfig({
+      optInStatusUrl: 'random-endpoint',
+    });
+    deprecateEndpointConfigs(rawConfig, fromPath, mockAddDeprecation);
+    expect(mockAddDeprecation).toBeCalledTimes(1);
+    expect(mockAddDeprecation.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "correctiveActions": Object {
+            "manualSteps": Array [
+              "Remove \\"telemetry.optInStatusUrl\\" from the Kibana configuration.",
+              "To send usage to the staging endpoint add \\"telemetry.sendUsageTo: staging\\" to the Kibana configuration.",
+            ],
+          },
+          "message": "\\"telemetry.optInStatusUrl\\" has been deprecated. Set \\"telemetry.sendUsageTo: staging\\" to the Kibana configurations to send usage to the staging endpoint.",
+        },
+      ]
+    `);
+  });
+});
diff --git a/src/plugins/telemetry/server/config/deprecations.ts b/src/plugins/telemetry/server/config/deprecations.ts
new file mode 100644
index 00000000000000..5507c3e1f6675b
--- /dev/null
+++ b/src/plugins/telemetry/server/config/deprecations.ts
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { i18n } from '@kbn/i18n';
+import type { ConfigDeprecation } from 'kibana/server';
+import type { TelemetryConfigType } from './config';
+
+export const deprecateEndpointConfigs: ConfigDeprecation = (
+  rawConfig,
+  fromPath,
+  addDeprecation
+) => {
+  const telemetryConfig: TelemetryConfigType = rawConfig[fromPath];
+  if (!telemetryConfig) {
+    return;
+  }
+
+  const unset: Array<{ path: string }> = [];
+  const endpointConfigPaths = ['url', 'optInStatusUrl'] as const;
+  let useStaging = telemetryConfig.sendUsageTo === 'staging' ? true : false;
+
+  for (const configPath of endpointConfigPaths) {
+    const configValue = telemetryConfig[configPath];
+    const fullConfigPath = `telemetry.${configPath}`;
+    if (typeof configValue !== 'undefined') {
+      unset.push({ path: fullConfigPath });
+
+      if (/telemetry-staging\.elastic\.co/i.test(configValue)) {
+        useStaging = true;
+      }
+
+      addDeprecation({
+        message: i18n.translate('telemetry.endpointConfigs.deprecationMessage', {
+          defaultMessage:
+            '"{configPath}" has been deprecated. Set "telemetry.sendUsageTo: staging" to the Kibana configurations to send usage to the staging endpoint.',
+          values: { configPath: fullConfigPath },
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('telemetry.endpointConfigs.deprecationManualStep1', {
+              defaultMessage: 'Remove "{configPath}" from the Kibana configuration.',
+              values: { configPath: fullConfigPath },
+            }),
+            i18n.translate('telemetry.endpointConfigs.deprecationManualStep2', {
+              defaultMessage:
+                'To send usage to the staging endpoint add "telemetry.sendUsageTo: staging" to the Kibana configuration.',
+            }),
+          ],
+        },
+      });
+    }
+  }
+
+  return {
+    set: [{ path: 'telemetry.sendUsageTo', value: useStaging ? 'staging' : 'prod' }],
+    unset,
+  };
+};
diff --git a/src/plugins/telemetry/server/config/index.ts b/src/plugins/telemetry/server/config/index.ts
new file mode 100644
index 00000000000000..19ccd73e17fcde
--- /dev/null
+++ b/src/plugins/telemetry/server/config/index.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { config } from './config';
+export type { TelemetryConfigType } from './config';
diff --git a/src/plugins/telemetry/server/fetcher.ts b/src/plugins/telemetry/server/fetcher.ts
index fb188a2414b989..e15b5be2604ec4 100644
--- a/src/plugins/telemetry/server/fetcher.ts
+++ b/src/plugins/telemetry/server/fetcher.ts
@@ -19,6 +19,7 @@ import {
   ICustomClusterClient,
 } from '../../../core/server';
 import {
+  getTelemetryChannelEndpoint,
   getTelemetryOptIn,
   getTelemetrySendUsageFrom,
   getTelemetryFailureDetails,
@@ -139,7 +140,10 @@ export class FetcherTask {
     const configTelemetrySendUsageFrom = config.sendUsageFrom;
     const allowChangingOptInStatus = config.allowChangingOptInStatus;
     const configTelemetryOptIn = typeof config.optIn === 'undefined' ? null : config.optIn;
-    const telemetryUrl = config.url;
+    const telemetryUrl = getTelemetryChannelEndpoint({
+      channelName: 'main',
+      env: config.sendUsageTo,
+    });
     const { failureCount, failureVersion } = getTelemetryFailureDetails({
       telemetrySavedObject,
     });
@@ -208,17 +212,17 @@ export class FetcherTask {
     });
   }
 
-  private async sendTelemetry(url: string, cluster: string): Promise<void> {
+  private async sendTelemetry(telemetryUrl: string, cluster: string): Promise<void> {
     this.logger.debug(`Sending usage stats.`);
     /**
      * send OPTIONS before sending usage data.
      * OPTIONS is less intrusive as it does not contain any payload and is used here to check if the endpoint is reachable.
      */
-    await fetch(url, {
+    await fetch(telemetryUrl, {
       method: 'options',
     });
 
-    await fetch(url, {
+    await fetch(telemetryUrl, {
       method: 'post',
       body: cluster,
       headers: { 'X-Elastic-Stack-Version': this.currentKibanaVersion },
diff --git a/src/plugins/telemetry/server/index.ts b/src/plugins/telemetry/server/index.ts
index 530f7c499c3f20..6b56996c756aa7 100644
--- a/src/plugins/telemetry/server/index.ts
+++ b/src/plugins/telemetry/server/index.ts
@@ -6,25 +6,13 @@
  * Side Public License, v 1.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'kibana/server';
+import type { PluginInitializerContext } from 'kibana/server';
+import type { TelemetryConfigType } from './config';
 import { TelemetryPlugin } from './plugin';
-import { configSchema, TelemetryConfigType } from './config';
 
+export { config } from './config';
 export type { TelemetryPluginSetup, TelemetryPluginStart } from './plugin';
 
-export const config: PluginConfigDescriptor<TelemetryConfigType> = {
-  schema: configSchema,
-  exposeToBrowser: {
-    enabled: true,
-    url: true,
-    banner: true,
-    allowChangingOptInStatus: true,
-    optIn: true,
-    optInStatusUrl: true,
-    sendUsageFrom: true,
-  },
-};
-
 export const plugin = (initializerContext: PluginInitializerContext<TelemetryConfigType>) =>
   new TelemetryPlugin(initializerContext);
 export { getClusterUuids, getLocalStats } from './telemetry_collection';
diff --git a/src/plugins/telemetry/server/plugin.ts b/src/plugins/telemetry/server/plugin.ts
index 40714bf4cf2be2..d38f054a4402e0 100644
--- a/src/plugins/telemetry/server/plugin.ts
+++ b/src/plugins/telemetry/server/plugin.ts
@@ -30,11 +30,11 @@ import {
   registerTelemetryUsageCollector,
   registerTelemetryPluginUsageCollector,
 } from './collectors';
-import { TelemetryConfigType } from './config';
+import type { TelemetryConfigType } from './config';
 import { FetcherTask } from './fetcher';
 import { handleOldSettings } from './handle_old_settings';
 import { getTelemetrySavedObject } from './telemetry_repository';
-import { getTelemetryOptIn } from '../common/telemetry_config';
+import { getTelemetryOptIn, getTelemetryChannelEndpoint } from '../common/telemetry_config';
 
 interface TelemetryPluginsDepsSetup {
   usageCollection: UsageCollectionSetup;
@@ -117,8 +117,10 @@ export class TelemetryPlugin implements Plugin<TelemetryPluginSetup, TelemetryPl
 
     return {
       getTelemetryUrl: async () => {
-        const config = await config$.pipe(take(1)).toPromise();
-        return new URL(config.url);
+        const { sendUsageTo } = await config$.pipe(take(1)).toPromise();
+        const telemetryUrl = getTelemetryChannelEndpoint({ env: sendUsageTo, channelName: 'main' });
+
+        return new URL(telemetryUrl);
       },
     };
   }
diff --git a/src/plugins/telemetry/server/routes/telemetry_opt_in.ts b/src/plugins/telemetry/server/routes/telemetry_opt_in.ts
index 196631f33384dd..e3fad0642303c2 100644
--- a/src/plugins/telemetry/server/routes/telemetry_opt_in.ts
+++ b/src/plugins/telemetry/server/routes/telemetry_opt_in.ts
@@ -83,15 +83,15 @@ export function registerTelemetryOptInRoutes({
       );
 
       if (config.sendUsageFrom === 'server') {
-        const optInStatusUrl = config.optInStatusUrl;
+        const { sendUsageTo } = config;
         sendTelemetryOptInStatus(
           telemetryCollectionManager,
-          { optInStatusUrl, newOptInStatus, currentKibanaVersion },
+          { sendUsageTo, newOptInStatus, currentKibanaVersion },
           statsGetterConfig
         ).catch((err) => {
           // The server is likely behind a firewall and can't reach the remote service
           logger.warn(
-            `Failed to notify "${optInStatusUrl}" from the server about the opt-in selection. Possibly blocked by a firewall? - Error: ${err.message}`
+            `Failed to notify the telemetry endpoint about the opt-in selection. Possibly blocked by a firewall? - Error: ${err.message}`
           );
         });
       }
diff --git a/src/plugins/telemetry/server/routes/telemetry_opt_in_stats.test.ts b/src/plugins/telemetry/server/routes/telemetry_opt_in_stats.test.ts
index 6660a36e76199c..acc9a863af61b4 100644
--- a/src/plugins/telemetry/server/routes/telemetry_opt_in_stats.test.ts
+++ b/src/plugins/telemetry/server/routes/telemetry_opt_in_stats.test.ts
@@ -10,30 +10,53 @@ jest.mock('node-fetch');
 import fetch from 'node-fetch';
 import { sendTelemetryOptInStatus } from './telemetry_opt_in_stats';
 import { StatsGetterConfig } from 'src/plugins/telemetry_collection_manager/server';
-
+import { TELEMETRY_ENDPOINT } from '../../common/constants';
 describe('sendTelemetryOptInStatus', () => {
+  const mockStatsGetterConfig = { unencrypted: false } as StatsGetterConfig;
+  const mockTelemetryCollectionManager = {
+    getOptInStats: jest.fn().mockResolvedValue(['mock_opt_in_hashed_value']),
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
   it('calls fetch with the opt in status returned from the telemetryCollectionManager', async () => {
-    const mockOptInStatus = ['mock_opt_in_hashed_value'];
-    const mockTelemetryCollectionManager = {
-      getOptInStats: jest.fn().mockResolvedValue(mockOptInStatus),
-    };
     const mockConfig = {
-      optInStatusUrl: 'some_url',
+      sendUsageTo: 'prod' as const,
       newOptInStatus: true,
       currentKibanaVersion: 'mock_kibana_version',
     };
-    const mockStatsGetterConfig = {
-      unencrypted: false,
-    };
 
     const result = await sendTelemetryOptInStatus(
       mockTelemetryCollectionManager,
       mockConfig,
-      mockStatsGetterConfig as StatsGetterConfig
+      mockStatsGetterConfig
     );
     expect(result).toBeUndefined();
     expect(fetch).toBeCalledTimes(1);
-    expect(fetch).toBeCalledWith(mockConfig.optInStatusUrl, {
+    expect(fetch).toBeCalledWith(TELEMETRY_ENDPOINT.OPT_IN_STATUS_CHANNEL.PROD, {
+      method: 'post',
+      body: '["mock_opt_in_hashed_value"]',
+      headers: { 'X-Elastic-Stack-Version': mockConfig.currentKibanaVersion },
+    });
+  });
+
+  it('sends to staging endpoint on "sendUsageTo: staging"', async () => {
+    const mockConfig = {
+      sendUsageTo: 'staging' as const,
+      newOptInStatus: true,
+      currentKibanaVersion: 'mock_kibana_version',
+    };
+
+    await sendTelemetryOptInStatus(
+      mockTelemetryCollectionManager,
+      mockConfig,
+      mockStatsGetterConfig
+    );
+
+    expect(fetch).toBeCalledTimes(1);
+    expect(fetch).toBeCalledWith(TELEMETRY_ENDPOINT.OPT_IN_STATUS_CHANNEL.STAGING, {
       method: 'post',
       body: '["mock_opt_in_hashed_value"]',
       headers: { 'X-Elastic-Stack-Version': mockConfig.currentKibanaVersion },
diff --git a/src/plugins/telemetry/server/routes/telemetry_opt_in_stats.ts b/src/plugins/telemetry/server/routes/telemetry_opt_in_stats.ts
index 77ec981d4c35bf..f6b7eddcbe765c 100644
--- a/src/plugins/telemetry/server/routes/telemetry_opt_in_stats.ts
+++ b/src/plugins/telemetry/server/routes/telemetry_opt_in_stats.ts
@@ -14,9 +14,10 @@ import {
   TelemetryCollectionManagerPluginSetup,
   StatsGetterConfig,
 } from 'src/plugins/telemetry_collection_manager/server';
+import { getTelemetryChannelEndpoint } from '../../common/telemetry_config';
 
 interface SendTelemetryOptInStatusConfig {
-  optInStatusUrl: string;
+  sendUsageTo: 'staging' | 'prod';
   newOptInStatus: boolean;
   currentKibanaVersion: string;
 }
@@ -26,7 +27,12 @@ export async function sendTelemetryOptInStatus(
   config: SendTelemetryOptInStatusConfig,
   statsGetterConfig: StatsGetterConfig
 ) {
-  const { optInStatusUrl, newOptInStatus, currentKibanaVersion } = config;
+  const { sendUsageTo, newOptInStatus, currentKibanaVersion } = config;
+  const optInStatusUrl = getTelemetryChannelEndpoint({
+    env: sendUsageTo,
+    channelName: 'optInStatus',
+  });
+
   const optInStatus = await telemetryCollectionManager.getOptInStats(
     newOptInStatus,
     statsGetterConfig
diff --git a/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap b/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap
index 014142a2a3d068..7c9154cba4f885 100644
--- a/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap
+++ b/src/plugins/telemetry_management_section/public/components/__snapshots__/telemetry_management_section.test.tsx.snap
@@ -311,9 +311,8 @@ exports[`TelemetryManagementSectionComponent renders null because allowChangingO
         "banner": true,
         "enabled": true,
         "optIn": true,
-        "optInStatusUrl": "",
         "sendUsageFrom": "browser",
-        "url": "",
+        "sendUsageTo": "staging",
       },
       "fetchExample": [Function],
       "fetchTelemetry": [Function],
diff --git a/src/plugins/telemetry_management_section/public/components/telemetry_management_section.test.tsx b/src/plugins/telemetry_management_section/public/components/telemetry_management_section.test.tsx
index fe6f8e254142b5..b8332317e6b682 100644
--- a/src/plugins/telemetry_management_section/public/components/telemetry_management_section.test.tsx
+++ b/src/plugins/telemetry_management_section/public/components/telemetry_management_section.test.tsx
@@ -24,12 +24,11 @@ describe('TelemetryManagementSectionComponent', () => {
     const isSecurityExampleEnabled = jest.fn().mockReturnValue(true);
     const telemetryService = new TelemetryService({
       config: {
+        sendUsageTo: 'staging',
         enabled: true,
-        url: '',
         banner: true,
         allowChangingOptInStatus: true,
         optIn: true,
-        optInStatusUrl: '',
         sendUsageFrom: 'browser',
       },
       isScreenshotMode: false,
@@ -60,12 +59,11 @@ describe('TelemetryManagementSectionComponent', () => {
     const telemetryService = new TelemetryService({
       config: {
         enabled: true,
-        url: '',
         banner: true,
         allowChangingOptInStatus: true,
         optIn: false,
-        optInStatusUrl: '',
         sendUsageFrom: 'browser',
+        sendUsageTo: 'staging',
       },
       isScreenshotMode: false,
       reportOptInStatusChange: false,
@@ -116,11 +114,10 @@ describe('TelemetryManagementSectionComponent', () => {
     const telemetryService = new TelemetryService({
       config: {
         enabled: true,
-        url: '',
         banner: true,
         allowChangingOptInStatus: true,
         optIn: false,
-        optInStatusUrl: '',
+        sendUsageTo: 'staging',
         sendUsageFrom: 'browser',
       },
       isScreenshotMode: false,
@@ -165,11 +162,10 @@ describe('TelemetryManagementSectionComponent', () => {
     const telemetryService = new TelemetryService({
       config: {
         enabled: true,
-        url: '',
         banner: true,
         allowChangingOptInStatus: false,
         optIn: true,
-        optInStatusUrl: '',
+        sendUsageTo: 'staging',
         sendUsageFrom: 'browser',
       },
       isScreenshotMode: false,
@@ -205,11 +201,10 @@ describe('TelemetryManagementSectionComponent', () => {
     const telemetryService = new TelemetryService({
       config: {
         enabled: true,
-        url: '',
         banner: true,
         allowChangingOptInStatus: true,
         optIn: false,
-        optInStatusUrl: '',
+        sendUsageTo: 'staging',
         sendUsageFrom: 'browser',
       },
       isScreenshotMode: false,
@@ -246,11 +241,10 @@ describe('TelemetryManagementSectionComponent', () => {
     const telemetryService = new TelemetryService({
       config: {
         enabled: true,
-        url: '',
         banner: true,
         allowChangingOptInStatus: true,
         optIn: false,
-        optInStatusUrl: '',
+        sendUsageTo: 'staging',
         sendUsageFrom: 'browser',
       },
       isScreenshotMode: false,
@@ -287,11 +281,10 @@ describe('TelemetryManagementSectionComponent', () => {
     const telemetryService = new TelemetryService({
       config: {
         enabled: true,
-        url: '',
         banner: true,
         allowChangingOptInStatus: true,
         optIn: false,
-        optInStatusUrl: '',
+        sendUsageTo: 'staging',
         sendUsageFrom: 'browser',
       },
       isScreenshotMode: false,
@@ -328,11 +321,10 @@ describe('TelemetryManagementSectionComponent', () => {
     const telemetryService = new TelemetryService({
       config: {
         enabled: true,
-        url: '',
         banner: true,
         allowChangingOptInStatus: true,
         optIn: false,
-        optInStatusUrl: '',
+        sendUsageTo: 'staging',
         sendUsageFrom: 'browser',
       },
       isScreenshotMode: false,
@@ -379,11 +371,10 @@ describe('TelemetryManagementSectionComponent', () => {
     const telemetryService = new TelemetryService({
       config: {
         enabled: true,
-        url: '',
         banner: true,
         allowChangingOptInStatus: false,
         optIn: false,
-        optInStatusUrl: '',
+        sendUsageTo: 'staging',
         sendUsageFrom: 'browser',
       },
       isScreenshotMode: false,
diff --git a/src/plugins/telemetry_management_section/public/plugin.tsx b/src/plugins/telemetry_management_section/public/plugin.tsx
index 24583260329a69..2e3b1beb64d3c5 100644
--- a/src/plugins/telemetry_management_section/public/plugin.tsx
+++ b/src/plugins/telemetry_management_section/public/plugin.tsx
@@ -17,17 +17,6 @@ import {
   TelemetryManagementSectionWrapperProps,
 } from './components/telemetry_management_section_wrapper';
 
-export interface TelemetryPluginConfig {
-  enabled: boolean;
-  url: string;
-  banner: boolean;
-  allowChangingOptInStatus: boolean;
-  optIn: boolean | null;
-  optInStatusUrl: string;
-  sendUsageFrom: 'browser' | 'server';
-  telemetryNotifyUserAboutOptInDefault?: boolean;
-}
-
 export interface TelemetryManagementSectionPluginDepsSetup {
   telemetry: TelemetryPluginSetup;
   advancedSettings: AdvancedSettingsSetup;
diff --git a/src/plugins/vis_default_editor/kibana.json b/src/plugins/vis_default_editor/kibana.json
index c89e5ec1abaffc..93a5afed6a92e8 100644
--- a/src/plugins/vis_default_editor/kibana.json
+++ b/src/plugins/vis_default_editor/kibana.json
@@ -3,7 +3,7 @@
   "version": "kibana",
   "ui": true,
   "optionalPlugins": ["visualize"],
-  "requiredBundles": ["kibanaUtils", "kibanaReact", "data"],
+  "requiredBundles": ["kibanaUtils", "kibanaReact", "data", "fieldFormats"],
   "owner": {
     "name": "Kibana App",
     "githubTeam": "kibana-app"
diff --git a/src/plugins/vis_default_editor/public/components/options/percentage_mode.tsx b/src/plugins/vis_default_editor/public/components/options/percentage_mode.tsx
index 542055d185ec5d..74f254c6176bc0 100644
--- a/src/plugins/vis_default_editor/public/components/options/percentage_mode.tsx
+++ b/src/plugins/vis_default_editor/public/components/options/percentage_mode.tsx
@@ -12,7 +12,7 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiFieldText, EuiFormRow, EuiLink } from '@elastic/eui';
 import { SwitchOption } from './switch';
 import { useKibana } from '../../../../kibana_react/public';
-import { UI_SETTINGS } from '../../../../data/public';
+import { FORMATS_UI_SETTINGS } from '../../../../field_formats/common';
 
 export interface PercentageModeOptionProps {
   setValue: (
@@ -31,7 +31,9 @@ function PercentageModeOption({
   formatPattern,
 }: PercentageModeOptionProps) {
   const { services } = useKibana();
-  const defaultPattern = services.uiSettings?.get(UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN);
+  const defaultPattern = services.uiSettings?.get(
+    FORMATS_UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN
+  );
 
   return (
     <>
diff --git a/src/plugins/vis_default_editor/tsconfig.json b/src/plugins/vis_default_editor/tsconfig.json
index 27bb775c2d0e8a..34003bced5ad03 100644
--- a/src/plugins/vis_default_editor/tsconfig.json
+++ b/src/plugins/vis_default_editor/tsconfig.json
@@ -16,5 +16,6 @@
     { "path": "../visualize/tsconfig.json" },
     { "path": "../kibana_utils/tsconfig.json" },
     { "path": "../kibana_react/tsconfig.json" },
+    { "path": "../field_formats/tsconfig.json" }
   ]
 }
diff --git a/src/plugins/vis_type_metric/public/components/metric_vis_component.tsx b/src/plugins/vis_type_metric/public/components/metric_vis_component.tsx
index 66be8febc496f3..87ca902f6c0906 100644
--- a/src/plugins/vis_type_metric/public/components/metric_vis_component.tsx
+++ b/src/plugins/vis_type_metric/public/components/metric_vis_component.tsx
@@ -11,7 +11,7 @@ import React, { Component } from 'react';
 import { isColorDark } from '@elastic/eui';
 import { MetricVisValue } from './metric_vis_value';
 import { Input } from '../metric_vis_fn';
-import { FieldFormatsContentType, IFieldFormat } from '../../../data/public';
+import type { FieldFormatsContentType, IFieldFormat } from '../../../field_formats/common';
 import { Datatable } from '../../../expressions/public';
 import { getHeatmapColors } from '../../../charts/public';
 import { VisParams, MetricVisMetric } from '../types';
diff --git a/src/plugins/vis_type_metric/tsconfig.json b/src/plugins/vis_type_metric/tsconfig.json
index 7441848d5a4308..bee666a5906cd4 100644
--- a/src/plugins/vis_type_metric/tsconfig.json
+++ b/src/plugins/vis_type_metric/tsconfig.json
@@ -15,6 +15,7 @@
     { "path": "../charts/tsconfig.json" },
     { "path": "../expressions/tsconfig.json" },
     { "path": "../kibana_utils/tsconfig.json" },
-    { "path": "../vis_default_editor/tsconfig.json" }
+    { "path": "../vis_default_editor/tsconfig.json" },
+    { "path": "../field_formats/tsconfig.json" }
   ]
 }
diff --git a/src/plugins/vis_type_pie/public/pie_component.tsx b/src/plugins/vis_type_pie/public/pie_component.tsx
index b79eed2087a168..c0f4a8a6112f8d 100644
--- a/src/plugins/vis_type_pie/public/pie_component.tsx
+++ b/src/plugins/vis_type_pie/public/pie_component.tsx
@@ -26,7 +26,8 @@ import {
   ChartsPluginSetup,
   PaletteRegistry,
 } from '../../charts/public';
-import { DataPublicPluginStart, FieldFormat } from '../../data/public';
+import { DataPublicPluginStart } from '../../data/public';
+import type { FieldFormat } from '../../field_formats/common';
 import type { PersistedState } from '../../visualizations/public';
 import { Datatable, DatatableColumn, IInterpreterRenderHandlers } from '../../expressions/public';
 import { DEFAULT_PERCENT_DECIMALS } from '../common';
diff --git a/src/plugins/vis_type_pie/public/utils/filter_helpers.ts b/src/plugins/vis_type_pie/public/utils/filter_helpers.ts
index 251ff8acc698e9..f1a4791821c126 100644
--- a/src/plugins/vis_type_pie/public/utils/filter_helpers.ts
+++ b/src/plugins/vis_type_pie/public/utils/filter_helpers.ts
@@ -8,7 +8,8 @@
 
 import { LayerValue, SeriesIdentifier } from '@elastic/charts';
 import { Datatable, DatatableColumn } from '../../../expressions/public';
-import { DataPublicPluginStart, FieldFormat } from '../../../data/public';
+import { DataPublicPluginStart } from '../../../data/public';
+import type { FieldFormat } from '../../../field_formats/common';
 import { ClickTriggerEvent } from '../../../charts/public';
 import { ValueClickContext } from '../../../embeddable/public';
 import { BucketColumns } from '../types';
diff --git a/src/plugins/vis_type_pie/public/utils/get_split_dimension_accessor.ts b/src/plugins/vis_type_pie/public/utils/get_split_dimension_accessor.ts
index e1029b11a7b758..5addae51dd0116 100644
--- a/src/plugins/vis_type_pie/public/utils/get_split_dimension_accessor.ts
+++ b/src/plugins/vis_type_pie/public/utils/get_split_dimension_accessor.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 import { AccessorFn } from '@elastic/charts';
-import { FieldFormatsStart } from '../../../data/public';
+import type { FieldFormatsStart } from '../../../field_formats/public';
 import { DatatableColumn } from '../../../expressions/public';
 import { Dimension } from '../types';
 
diff --git a/src/plugins/vis_type_pie/tsconfig.json b/src/plugins/vis_type_pie/tsconfig.json
index f12db316f19723..69bd2855b9843f 100644
--- a/src/plugins/vis_type_pie/tsconfig.json
+++ b/src/plugins/vis_type_pie/tsconfig.json
@@ -20,5 +20,6 @@
       { "path": "../visualizations/tsconfig.json" },
       { "path": "../usage_collection/tsconfig.json" },
       { "path": "../vis_default_editor/tsconfig.json" },
+      { "path": "../field_formats/tsconfig.json" }
     ]
   }
\ No newline at end of file
diff --git a/src/plugins/vis_type_table/public/legacy/agg_table/agg_table.test.js b/src/plugins/vis_type_table/public/legacy/agg_table/agg_table.test.js
index cbc3db6585a7da..2f423538568bd5 100644
--- a/src/plugins/vis_type_table/public/legacy/agg_table/agg_table.test.js
+++ b/src/plugins/vis_type_table/public/legacy/agg_table/agg_table.test.js
@@ -17,7 +17,7 @@ import { getFieldFormatsRegistry } from '../../../../data/public/test_utils';
 import { coreMock } from '../../../../../core/public/mocks';
 import { initAngularBootstrap } from '../../../../kibana_legacy/public/angular_bootstrap';
 import { setUiSettings } from '../../../../data/public/services';
-import { UI_SETTINGS } from '../../../../data/public/';
+import { FORMATS_UI_SETTINGS } from '../../../../field_formats/common/';
 import { CSV_SEPARATOR_SETTING, CSV_QUOTE_VALUES_SETTING } from '../../../../share/public';
 
 import { setFormatService } from '../../services';
@@ -38,12 +38,12 @@ describe('Table Vis - AggTable Directive', function () {
     const defaultValues = {
       dateFormat: 'MMM D, YYYY @ HH:mm:ss.SSS',
       'dateFormat:tz': 'UTC',
-      [UI_SETTINGS.SHORT_DOTS_ENABLE]: true,
-      [UI_SETTINGS.FORMAT_CURRENCY_DEFAULT_PATTERN]: '($0,0.[00])',
-      [UI_SETTINGS.FORMAT_NUMBER_DEFAULT_PATTERN]: '0,0.[000]',
-      [UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN]: '0,0.[000]%',
-      [UI_SETTINGS.FORMAT_NUMBER_DEFAULT_LOCALE]: 'en',
-      [UI_SETTINGS.FORMAT_DEFAULT_TYPE_MAP]: {},
+      [FORMATS_UI_SETTINGS.SHORT_DOTS_ENABLE]: true,
+      [FORMATS_UI_SETTINGS.FORMAT_CURRENCY_DEFAULT_PATTERN]: '($0,0.[00])',
+      [FORMATS_UI_SETTINGS.FORMAT_NUMBER_DEFAULT_PATTERN]: '0,0.[000]',
+      [FORMATS_UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN]: '0,0.[000]%',
+      [FORMATS_UI_SETTINGS.FORMAT_NUMBER_DEFAULT_LOCALE]: 'en',
+      [FORMATS_UI_SETTINGS.FORMAT_DEFAULT_TYPE_MAP]: {},
       [CSV_SEPARATOR_SETTING]: ',',
       [CSV_QUOTE_VALUES_SETTING]: true,
     };
diff --git a/src/plugins/vis_type_table/public/types.ts b/src/plugins/vis_type_table/public/types.ts
index 8f35909d3bfba9..4df6f2b94e17b4 100644
--- a/src/plugins/vis_type_table/public/types.ts
+++ b/src/plugins/vis_type_table/public/types.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { IFieldFormat } from 'src/plugins/data/public';
+import type { IFieldFormat } from 'src/plugins/field_formats/common';
 import { DatatableColumn, DatatableRow } from 'src/plugins/expressions';
 import { ExpressionValueVisDimension } from 'src/plugins/visualizations/public';
 import { TableVisParams } from '../common';
diff --git a/src/plugins/vis_type_table/public/utils/add_percentage_column.test.ts b/src/plugins/vis_type_table/public/utils/add_percentage_column.test.ts
index 0280637acc0999..51eef1446bac63 100644
--- a/src/plugins/vis_type_table/public/utils/add_percentage_column.test.ts
+++ b/src/plugins/vis_type_table/public/utils/add_percentage_column.test.ts
@@ -12,7 +12,7 @@ jest.mock('../services', () => ({
   })),
 }));
 
-import { FieldFormat } from 'src/plugins/data/public';
+import type { FieldFormat } from 'src/plugins/field_formats/common';
 import { TableContext } from '../types';
 import { addPercentageColumn } from './add_percentage_column';
 
diff --git a/src/plugins/vis_type_table/tsconfig.json b/src/plugins/vis_type_table/tsconfig.json
index ccff3c349cf21c..50277d51e8748d 100644
--- a/src/plugins/vis_type_table/tsconfig.json
+++ b/src/plugins/vis_type_table/tsconfig.json
@@ -24,5 +24,6 @@
     { "path": "../kibana_legacy/tsconfig.json" },
     { "path": "../kibana_react/tsconfig.json" },
     { "path": "../vis_default_editor/tsconfig.json" },
+    { "path": "../field_formats/tsconfig.json" }
   ]
 }
diff --git a/src/plugins/vis_type_timelion/public/components/timelion_interval.tsx b/src/plugins/vis_type_timelion/public/components/timelion_interval.tsx
index 40702c39deaf49..047de1bdb07086 100644
--- a/src/plugins/vis_type_timelion/public/components/timelion_interval.tsx
+++ b/src/plugins/vis_type_timelion/public/components/timelion_interval.tsx
@@ -126,6 +126,7 @@ function TimelionInterval({ value, setValue, setValidity }: TimelionIntervalProp
         placeholder={i18n.translate('timelion.vis.selectIntervalPlaceholder', {
           defaultMessage: 'Select an interval',
         })}
+        data-test-subj="timelionIntervalComboBox"
       />
     </EuiFormRow>
   );
diff --git a/src/plugins/vis_type_timelion/public/components/timelion_vis_component.tsx b/src/plugins/vis_type_timelion/public/components/timelion_vis_component.tsx
index 4690f4fe11e458..858ba0ad64add5 100644
--- a/src/plugins/vis_type_timelion/public/components/timelion_vis_component.tsx
+++ b/src/plugins/vis_type_timelion/public/components/timelion_vis_component.tsx
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import React, { useEffect, useCallback, useMemo, useRef } from 'react';
+import React, { useCallback, useMemo, useRef } from 'react';
 import { compact, last, map } from 'lodash';
 import {
   Chart,
@@ -14,13 +14,13 @@ import {
   Position,
   Axis,
   TooltipType,
-  PointerEvent,
   LegendPositionConfig,
   LayoutDirection,
 } from '@elastic/charts';
 import { EuiTitle } from '@elastic/eui';
 
 import { useKibana } from '../../../kibana_react/public';
+import { useActiveCursor } from '../../../charts/public';
 
 import { AreaSeriesComponent, BarSeriesComponent } from './series';
 
@@ -33,7 +33,7 @@ import {
 } from '../helpers/panel_utils';
 
 import { colors } from '../helpers/chart_constants';
-import { activeCursor$ } from '../helpers/active_cursor';
+import { getCharts } from '../helpers/plugin_services';
 
 import type { Sheet } from '../helpers/timelion_request_handler';
 import type { IInterpreterRenderHandlers } from '../../../expressions';
@@ -43,6 +43,15 @@ import type { Series } from '../helpers/timelion_request_handler';
 
 import './timelion_vis.scss';
 
+declare global {
+  interface Window {
+    /**
+     * Flag used to enable debugState on elastic charts
+     */
+    _echDebugStateFlag?: boolean;
+  }
+}
+
 interface TimelionVisComponentProps {
   interval: string;
   seriesList: Sheet;
@@ -91,20 +100,14 @@ const TimelionVisComponent = ({
   const kibana = useKibana<TimelionVisDependencies>();
   const chartRef = useRef<Chart>(null);
   const chart = seriesList.list;
+  const chartsService = getCharts();
 
-  useEffect(() => {
-    const subscription = activeCursor$.subscribe((cursor: PointerEvent) => {
-      chartRef.current?.dispatchExternalPointerEvent(cursor);
-    });
-
-    return () => {
-      subscription.unsubscribe();
-    };
-  }, []);
+  const chartTheme = chartsService.theme.useChartsTheme();
+  const chartBaseTheme = chartsService.theme.useChartsBaseTheme();
 
-  const handleCursorUpdate = useCallback((cursor: PointerEvent) => {
-    activeCursor$.next(cursor);
-  }, []);
+  const handleCursorUpdate = useActiveCursor(chartsService.activeCursor, chartRef, {
+    isDateHistogram: true,
+  });
 
   const brushEndListener = useCallback(
     ({ x }) => {
@@ -174,7 +177,7 @@ const TimelionVisComponent = ({
   }, [chart]);
 
   return (
-    <div className="timelionChart">
+    <div className="timelionChart" data-test-subj="visTypeXyChart">
       {title && (
         <EuiTitle className="timelionChart__topTitle" size="xxxs">
           <h4>{title}</h4>
@@ -182,14 +185,15 @@ const TimelionVisComponent = ({
       )}
       <Chart ref={chartRef} renderer="canvas" size={{ width: '100%' }}>
         <Settings
+          debugState={window._echDebugStateFlag ?? false}
           onBrushEnd={brushEndListener}
           showLegend={legend.showLegend}
           showLegendExtra={true}
           legendPosition={legend.legendPosition}
           onRenderChange={onRenderChange}
           onPointerUpdate={handleCursorUpdate}
-          theme={kibana.services.chartTheme.useChartsTheme()}
-          baseTheme={kibana.services.chartTheme.useChartsBaseTheme()}
+          theme={chartTheme}
+          baseTheme={chartBaseTheme}
           tooltip={{
             snap: true,
             headerFormatter: ({ value }) => tickFormat(value),
diff --git a/src/plugins/vis_type_timelion/public/helpers/plugin_services.ts b/src/plugins/vis_type_timelion/public/helpers/plugin_services.ts
index 31ec504c3151bd..58fcf510ff7923 100644
--- a/src/plugins/vis_type_timelion/public/helpers/plugin_services.ts
+++ b/src/plugins/vis_type_timelion/public/helpers/plugin_services.ts
@@ -7,6 +7,7 @@
  */
 
 import type { IndexPatternsContract, ISearchStart } from 'src/plugins/data/public';
+import type { ChartsPluginStart } from 'src/plugins/charts/public';
 import { createGetterSetter } from '../../../kibana_utils/public';
 
 export const [getIndexPatterns, setIndexPatterns] = createGetterSetter<IndexPatternsContract>(
@@ -14,3 +15,5 @@ export const [getIndexPatterns, setIndexPatterns] = createGetterSetter<IndexPatt
 );
 
 export const [getDataSearch, setDataSearch] = createGetterSetter<ISearchStart>('Search');
+
+export const [getCharts, setCharts] = createGetterSetter<ChartsPluginStart>('Charts');
diff --git a/src/plugins/vis_type_timelion/public/plugin.ts b/src/plugins/vis_type_timelion/public/plugin.ts
index 93712ae4507feb..1784af4e772220 100644
--- a/src/plugins/vis_type_timelion/public/plugin.ts
+++ b/src/plugins/vis_type_timelion/public/plugin.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import {
+import type {
   CoreSetup,
   CoreStart,
   Plugin,
@@ -14,30 +14,29 @@ import {
   IUiSettingsClient,
   HttpSetup,
 } from 'kibana/public';
-import { Plugin as ExpressionsPlugin } from 'src/plugins/expressions/public';
-import {
+import type { Plugin as ExpressionsPlugin } from 'src/plugins/expressions/public';
+import type {
   DataPublicPluginSetup,
   DataPublicPluginStart,
   TimefilterContract,
 } from 'src/plugins/data/public';
-
-import { VisualizationsSetup } from '../../visualizations/public';
-import { ChartsPluginSetup } from '../../charts/public';
+import type { VisualizationsSetup } from 'src/plugins/visualizations/public';
+import type { ChartsPluginSetup, ChartsPluginStart } from 'src/plugins/charts/public';
 
 import { getTimelionVisualizationConfig } from './timelion_vis_fn';
 import { getTimelionVisDefinition } from './timelion_vis_type';
-import { setIndexPatterns, setDataSearch } from './helpers/plugin_services';
-import { ConfigSchema } from '../config';
+import { setIndexPatterns, setDataSearch, setCharts } from './helpers/plugin_services';
 
 import { getArgValueSuggestions } from './helpers/arg_value_suggestions';
 import { getTimelionVisRenderer } from './timelion_vis_renderer';
 
+import type { ConfigSchema } from '../config';
+
 /** @internal */
 export interface TimelionVisDependencies extends Partial<CoreStart> {
   uiSettings: IUiSettingsClient;
   http: HttpSetup;
   timefilter: TimefilterContract;
-  chartTheme: ChartsPluginSetup['theme'];
 }
 
 /** @internal */
@@ -51,6 +50,7 @@ export interface TimelionVisSetupDependencies {
 /** @internal */
 export interface TimelionVisStartDependencies {
   data: DataPublicPluginStart;
+  charts: ChartsPluginStart;
 }
 
 /** @public */
@@ -82,7 +82,6 @@ export class TimelionVisPlugin
       http,
       uiSettings,
       timefilter: data.query.timefilter.timefilter,
-      chartTheme: charts.theme,
     };
 
     expressions.registerFunction(() => getTimelionVisualizationConfig(dependencies));
@@ -94,9 +93,10 @@ export class TimelionVisPlugin
     };
   }
 
-  public start(core: CoreStart, plugins: TimelionVisStartDependencies) {
-    setIndexPatterns(plugins.data.indexPatterns);
-    setDataSearch(plugins.data.search);
+  public start(core: CoreStart, { data, charts }: TimelionVisStartDependencies) {
+    setIndexPatterns(data.indexPatterns);
+    setDataSearch(data.search);
+    setCharts(charts);
 
     return {
       getArgValueSuggestions,
diff --git a/src/plugins/vis_type_timeseries/kibana.json b/src/plugins/vis_type_timeseries/kibana.json
index 3a2ad6bdd77cf8..c172640a4c14ee 100644
--- a/src/plugins/vis_type_timeseries/kibana.json
+++ b/src/plugins/vis_type_timeseries/kibana.json
@@ -6,7 +6,7 @@
   "ui": true,
   "requiredPlugins": ["charts", "data", "expressions", "visualizations", "visualize"],
   "optionalPlugins": ["usageCollection"],
-  "requiredBundles": ["kibanaUtils", "kibanaReact"],
+  "requiredBundles": ["kibanaUtils", "kibanaReact", "fieldFormats"],
   "owner": {
     "name": "Kibana App",
     "githubTeam": "kibana-app"
diff --git a/src/plugins/vis_type_timeseries/public/application/components/lib/tick_formatter.test.js b/src/plugins/vis_type_timeseries/public/application/components/lib/tick_formatter.test.js
index 04af5786d2e8ea..9b9beae67e44f4 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/lib/tick_formatter.test.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/lib/tick_formatter.test.js
@@ -10,6 +10,7 @@ import { createTickFormatter } from './tick_formatter';
 import { getFieldFormatsRegistry } from '../../../../../data/public/test_utils';
 import { setFieldFormats } from '../../../services';
 import { UI_SETTINGS } from '../../../../../data/public';
+import { FORMATS_UI_SETTINGS } from '../../../../../field_formats/common';
 
 const mockUiSettings = {
   get: (item) => {
@@ -22,7 +23,7 @@ const mockUiSettings = {
   [UI_SETTINGS.QUERY_STRING_OPTIONS]: {},
   [UI_SETTINGS.COURIER_IGNORE_FILTER_IF_FIELD_NOT_IN_INDEX]: true,
   'dateFormat:tz': 'Browser',
-  [UI_SETTINGS.FORMAT_DEFAULT_TYPE_MAP]: {},
+  [FORMATS_UI_SETTINGS.FORMAT_DEFAULT_TYPE_MAP]: {},
 };
 
 const mockCore = {
@@ -45,7 +46,7 @@ describe('createTickFormatter(format, template)', () => {
 
   test('returns a percent with percent formatter', () => {
     const config = {
-      [UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN]: '0.[00]%',
+      [FORMATS_UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN]: '0.[00]%',
     };
     const fn = createTickFormatter('percent', null, (key) => config[key]);
     expect(fn(0.5556)).toEqual('55.56%');
@@ -53,7 +54,7 @@ describe('createTickFormatter(format, template)', () => {
 
   test('returns a byte formatted string with byte formatter', () => {
     const config = {
-      [UI_SETTINGS.FORMAT_BYTES_DEFAULT_PATTERN]: '0.0b',
+      [FORMATS_UI_SETTINGS.FORMAT_BYTES_DEFAULT_PATTERN]: '0.0b',
     };
     const fn = createTickFormatter('bytes', null, (key) => config[key]);
     expect(fn(1500 ^ 10)).toEqual('1.5KB');
@@ -66,7 +67,7 @@ describe('createTickFormatter(format, template)', () => {
 
   test('returns a located string with custom locale setting', () => {
     const config = {
-      [UI_SETTINGS.FORMAT_NUMBER_DEFAULT_LOCALE]: 'fr',
+      [FORMATS_UI_SETTINGS.FORMAT_NUMBER_DEFAULT_LOCALE]: 'fr',
     };
     const fn = createTickFormatter('0,0.0', null, (key) => config[key]);
     expect(fn(1500)).toEqual('1 500,0');
@@ -89,7 +90,7 @@ describe('createTickFormatter(format, template)', () => {
 
   test('returns formatted value if passed a bad template', () => {
     const config = {
-      [UI_SETTINGS.FORMAT_NUMBER_DEFAULT_PATTERN]: '0,0.[00]',
+      [FORMATS_UI_SETTINGS.FORMAT_NUMBER_DEFAULT_PATTERN]: '0,0.[00]',
     };
     const fn = createTickFormatter('number', '{{value', (key) => config[key]);
     expect(fn(1.5556)).toEqual('1.56');
diff --git a/src/plugins/vis_type_timeseries/public/application/components/vis_types/table/vis.js b/src/plugins/vis_type_timeseries/public/application/components/vis_types/table/vis.js
index 4db038de912f5c..ba235a20b97ce2 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/vis_types/table/vis.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/vis_types/table/vis.js
@@ -15,7 +15,7 @@ import { createTickFormatter } from '../../lib/tick_formatter';
 import { isSortable } from './is_sortable';
 import { EuiToolTip, EuiIcon } from '@elastic/eui';
 import { replaceVars } from '../../lib/replace_vars';
-import { fieldFormats } from '../../../../../../../plugins/data/public';
+import { FIELD_FORMAT_IDS } from '../../../../../../../plugins/field_formats/common';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { getFieldFormats, getCoreStart } from '../../../../services';
 import { getValueOrEmpty } from '../../../../../common/empty_label';
@@ -47,7 +47,7 @@ class TableVis extends Component {
     super(props);
 
     const fieldFormatsService = getFieldFormats();
-    const DateFormat = fieldFormatsService.getType(fieldFormats.FIELD_FORMAT_IDS.DATE);
+    const DateFormat = fieldFormatsService.getType(FIELD_FORMAT_IDS.DATE);
 
     this.dateFormatter = new DateFormat({}, this.props.getConfig);
   }
diff --git a/src/plugins/vis_type_timeseries/public/application/components/vis_types/timeseries/config.js b/src/plugins/vis_type_timeseries/public/application/components/vis_types/timeseries/config.js
index 81b8626261f436..01ba8b6e28114a 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/vis_types/timeseries/config.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/vis_types/timeseries/config.js
@@ -28,7 +28,7 @@ import {
 import { FormattedMessage, injectI18n } from '@kbn/i18n/react';
 import { SeriesConfigQueryBarWithIgnoreGlobalFilter } from '../../series_config_query_bar_with_ignore_global_filter';
 import { PalettePicker } from '../../palette_picker';
-import { getChartsSetup } from '../../../../services';
+import { getCharts } from '../../../../services';
 import { isPercentDisabled } from '../../lib/stacked';
 import { STACKED_OPTIONS } from '../../../visualizations/constants/chart';
 
@@ -120,7 +120,7 @@ export const TimeseriesConfig = injectI18n(function (props) {
   const selectedChartTypeOption = chartTypeOptions.find((option) => {
     return model.chart_type === option.value;
   });
-  const { palettes } = getChartsSetup();
+  const { palettes } = getCharts();
   const [palettesRegistry, setPalettesRegistry] = useState(null);
 
   useEffect(() => {
diff --git a/src/plugins/vis_type_timeseries/public/application/components/vis_types/timeseries/vis.test.js b/src/plugins/vis_type_timeseries/public/application/components/vis_types/timeseries/vis.test.js
index b2aa4a6d0c9feb..fd155623d5da7d 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/vis_types/timeseries/vis.test.js
+++ b/src/plugins/vis_type_timeseries/public/application/components/vis_types/timeseries/vis.test.js
@@ -11,14 +11,14 @@ import { shallow } from 'enzyme';
 import { TimeSeries } from '../../../visualizations/views/timeseries';
 import TimeseriesVisualization from './vis';
 import { setFieldFormats } from '../../../../services';
-import { UI_SETTINGS } from '../../../../../../data/public';
+import { FORMATS_UI_SETTINGS } from '../../../../../../field_formats/common';
 import { getFieldFormatsRegistry } from '../../../../../../data/public/test_utils';
 
 describe('TimeseriesVisualization', () => {
   describe('TimeSeries Y-Axis formatted value', () => {
     const config = {
-      [UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN]: '0.[00]%',
-      [UI_SETTINGS.FORMAT_BYTES_DEFAULT_PATTERN]: '0.0b',
+      [FORMATS_UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN]: '0.[00]%',
+      [FORMATS_UI_SETTINGS.FORMAT_BYTES_DEFAULT_PATTERN]: '0.0b',
     };
     const id = 'default';
     const value = 500;
diff --git a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/index.js b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/index.js
index 76bf3ca9d1b6ee..0f0879e8478464 100644
--- a/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/index.js
+++ b/src/plugins/vis_type_timeseries/public/application/visualizations/views/timeseries/index.js
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import React, { useEffect, useRef, useCallback } from 'react';
+import React, { useRef, useCallback } from 'react';
 import PropTypes from 'prop-types';
 import classNames from 'classnames';
 import { labelDateFormatter } from '../../../components/lib/label_date_formatter';
@@ -23,8 +23,7 @@ import {
 } from '@elastic/charts';
 import { EuiIcon } from '@elastic/eui';
 import { getTimezone } from '../../../lib/get_timezone';
-import { activeCursor$ } from '../../lib/active_cursor';
-import { getUISettings, getChartsSetup } from '../../../../services';
+import { getUISettings, getCharts } from '../../../../services';
 import { GRID_LINE_CONFIG, ICON_TYPES_MAP, STACKED_OPTIONS } from '../../constants';
 import { AreaSeriesDecorator } from './decorators/area_decorator';
 import { BarSeriesDecorator } from './decorators/bar_decorator';
@@ -33,7 +32,7 @@ import { getBaseTheme, getChartClasses } from './utils/theme';
 import { TOOLTIP_MODES } from '../../../../../common/enums';
 import { getValueOrEmpty } from '../../../../../common/empty_label';
 import { getSplitByTermsColor } from '../../../lib/get_split_by_terms_color';
-import { renderEndzoneTooltip } from '../../../../../../charts/public';
+import { renderEndzoneTooltip, useActiveCursor } from '../../../../../../charts/public';
 import { getAxisLabelString } from '../../../components/lib/get_axis_label_string';
 import { calculateDomainForSeries } from './utils/series_domain_calculation';
 
@@ -48,10 +47,6 @@ const generateAnnotationData = (values, formatter) =>
 
 const decorateFormatter = (formatter) => ({ value }) => formatter(value);
 
-const handleCursorUpdate = (cursor) => {
-  activeCursor$.next(cursor);
-};
-
 export const TimeSeries = ({
   backgroundColor,
   showGrid,
@@ -69,22 +64,17 @@ export const TimeSeries = ({
   interval,
   isLastBucketDropped,
 }) => {
-  const chartRef = useRef();
-  // const [palettesRegistry, setPalettesRegistry] = useState(null);
-
-  useEffect(() => {
-    const updateCursor = (cursor) => {
-      if (chartRef.current) {
-        chartRef.current.dispatchExternalPointerEvent(cursor);
-      }
-    };
+  // If the color isn't configured by the user, use the color mapping service
+  // to assign a color from the Kibana palette. Colors will be shared across the
+  // session, including dashboards.
+  const { theme: themeService, activeCursor: activeCursorService } = getCharts();
 
-    const subscription = activeCursor$.subscribe(updateCursor);
+  const chartRef = useRef();
+  const chartTheme = themeService.useChartsTheme();
 
-    return () => {
-      subscription.unsubscribe();
-    };
-  }, []);
+  const handleCursorUpdate = useActiveCursor(activeCursorService, chartRef, {
+    isDateHistogram: true,
+  });
 
   let tooltipFormatter = decorateFormatter(xAxisFormatter);
   if (!isLastBucketDropped) {
@@ -104,11 +94,6 @@ export const TimeSeries = ({
   // apply legend style change if bgColor is configured
   const classes = classNames(getChartClasses(backgroundColor));
 
-  // If the color isn't configured by the user, use the color mapping service
-  // to assign a color from the Kibana palette. Colors will be shared across the
-  // session, including dashboards.
-  const { theme: themeService } = getChartsSetup();
-
   const baseTheme = getBaseTheme(themeService.useChartsBaseTheme(), backgroundColor);
 
   const onBrushEndListener = ({ x }) => {
@@ -152,6 +137,7 @@ export const TimeSeries = ({
         animateData={false}
         onPointerUpdate={handleCursorUpdate}
         theme={[
+          chartTheme,
           hasBarChart
             ? {}
             : {
diff --git a/src/plugins/vis_type_timeseries/public/plugin.ts b/src/plugins/vis_type_timeseries/public/plugin.ts
index 479c3f47435cc8..3cd090c7da8293 100644
--- a/src/plugins/vis_type_timeseries/public/plugin.ts
+++ b/src/plugins/vis_type_timeseries/public/plugin.ts
@@ -20,23 +20,23 @@ import {
   setFieldFormats,
   setCoreStart,
   setDataStart,
-  setChartsSetup,
+  setCharts,
 } from './services';
 import { DataPublicPluginStart } from '../../data/public';
-import { ChartsPluginSetup } from '../../charts/public';
+import { ChartsPluginStart } from '../../charts/public';
 import { getTimeseriesVisRenderer } from './timeseries_vis_renderer';
 
 /** @internal */
 export interface MetricsPluginSetupDependencies {
   expressions: ReturnType<ExpressionsPublicPlugin['setup']>;
   visualizations: VisualizationsSetup;
-  charts: ChartsPluginSetup;
   visualize: VisualizePluginSetup;
 }
 
 /** @internal */
 export interface MetricsPluginStartDependencies {
   data: DataPublicPluginStart;
+  charts: ChartsPluginStart;
 }
 
 /** @internal */
@@ -49,7 +49,7 @@ export class MetricsPlugin implements Plugin<void, void> {
 
   public setup(
     core: CoreSetup,
-    { expressions, visualizations, charts, visualize }: MetricsPluginSetupDependencies
+    { expressions, visualizations, visualize }: MetricsPluginSetupDependencies
   ) {
     visualize.visEditorsRegistry.register(TSVB_EDITOR_NAME, EditorController);
     expressions.registerFunction(createMetricsFn);
@@ -59,11 +59,11 @@ export class MetricsPlugin implements Plugin<void, void> {
       })
     );
     setUISettings(core.uiSettings);
-    setChartsSetup(charts);
     visualizations.createBaseVisualization(metricsVisDefinition);
   }
 
-  public start(core: CoreStart, { data }: MetricsPluginStartDependencies) {
+  public start(core: CoreStart, { data, charts }: MetricsPluginStartDependencies) {
+    setCharts(charts);
     setI18n(core.i18n);
     setFieldFormats(data.fieldFormats);
     setDataStart(data);
diff --git a/src/plugins/vis_type_timeseries/public/services.ts b/src/plugins/vis_type_timeseries/public/services.ts
index 22f99f95691ded..da1fd0fbdc2d35 100644
--- a/src/plugins/vis_type_timeseries/public/services.ts
+++ b/src/plugins/vis_type_timeseries/public/services.ts
@@ -8,7 +8,7 @@
 
 import { I18nStart, IUiSettingsClient, CoreStart } from 'src/core/public';
 import { createGetterSetter } from '../../kibana_utils/public';
-import { ChartsPluginSetup } from '../../charts/public';
+import { ChartsPluginStart } from '../../charts/public';
 import { DataPublicPluginStart } from '../../data/public';
 
 export const [getUISettings, setUISettings] = createGetterSetter<IUiSettingsClient>('UISettings');
@@ -23,6 +23,4 @@ export const [getDataStart, setDataStart] = createGetterSetter<DataPublicPluginS
 
 export const [getI18n, setI18n] = createGetterSetter<I18nStart>('I18n');
 
-export const [getChartsSetup, setChartsSetup] = createGetterSetter<ChartsPluginSetup>(
-  'ChartsPluginSetup'
-);
+export const [getCharts, setCharts] = createGetterSetter<ChartsPluginStart>('ChartsPluginStart');
diff --git a/src/plugins/vis_type_timeseries/public/timeseries_vis_renderer.tsx b/src/plugins/vis_type_timeseries/public/timeseries_vis_renderer.tsx
index 7a358718c1495b..3f324fcfc2f206 100644
--- a/src/plugins/vis_type_timeseries/public/timeseries_vis_renderer.tsx
+++ b/src/plugins/vis_type_timeseries/public/timeseries_vis_renderer.tsx
@@ -17,7 +17,7 @@ import { VisualizationContainer, PersistedState } from '../../visualizations/pub
 
 import type { TimeseriesVisData } from '../common/types';
 import { isVisTableData } from '../common/vis_data_utils';
-import { getChartsSetup } from './services';
+import { getCharts } from './services';
 
 import type { TimeseriesVisParams } from './types';
 import type { ExpressionRenderDefinition } from '../../expressions/common';
@@ -49,7 +49,7 @@ export const getTimeseriesVisRenderer: (deps: {
     handlers.onDestroy(() => {
       unmountComponentAtNode(domNode);
     });
-    const { palettes } = getChartsSetup();
+    const { palettes } = getCharts();
     const showNoResult = !checkIfDataExists(config.visData, config.visParams);
     const palettesService = await palettes.getPalettes();
 
diff --git a/src/plugins/vis_type_vislib/kibana.json b/src/plugins/vis_type_vislib/kibana.json
index 26d20b1ff839f7..412264a3e7270d 100644
--- a/src/plugins/vis_type_vislib/kibana.json
+++ b/src/plugins/vis_type_vislib/kibana.json
@@ -4,7 +4,7 @@
   "server": true,
   "ui": true,
   "requiredPlugins": ["charts", "data", "expressions", "visualizations", "kibanaLegacy"],
-  "requiredBundles": ["kibanaUtils", "visDefaultEditor", "visTypeXy", "visTypePie"],
+  "requiredBundles": ["kibanaUtils", "visDefaultEditor", "visTypeXy", "visTypePie", "fieldFormats"],
   "owner": {
     "name": "Kibana App",
     "githubTeam": "kibana-app"
diff --git a/src/plugins/vis_type_vislib/public/vislib/components/tooltip/_pointseries_tooltip_formatter.js b/src/plugins/vis_type_vislib/public/vislib/components/tooltip/_pointseries_tooltip_formatter.js
index 5e1f0bfbb44644..04ab8db1cda8fa 100644
--- a/src/plugins/vis_type_vislib/public/vislib/components/tooltip/_pointseries_tooltip_formatter.js
+++ b/src/plugins/vis_type_vislib/public/vislib/components/tooltip/_pointseries_tooltip_formatter.js
@@ -9,7 +9,7 @@
 import { last } from 'lodash';
 import React from 'react';
 import { renderToStaticMarkup } from 'react-dom/server';
-import { UI_SETTINGS } from '../../../../../../plugins/data/public';
+import { FORMATS_UI_SETTINGS } from '../../../../../../plugins/field_formats/common';
 import { getValueForPercentageMode } from '../../percentage_mode_transform';
 
 function getMax(handler, config, isGauge) {
@@ -55,7 +55,7 @@ export function pointSeriesTooltipFormatter() {
       if (isPercentageMode && !isSetColorRange) {
         const percentageFormatPattern = config.get(
           isGauge ? 'gauge.percentageFormatPattern' : 'percentageFormatPattern',
-          uiSettings.get(UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN)
+          uiSettings.get(FORMATS_UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN)
         );
         value = getValueForPercentageMode(
           value / getMax(handler, config, isGauge),
diff --git a/src/plugins/vis_type_vislib/public/vislib/helpers/point_series/_get_point.test.ts b/src/plugins/vis_type_vislib/public/vislib/helpers/point_series/_get_point.test.ts
index 04afc86548f221..815d0e10aafb2c 100644
--- a/src/plugins/vis_type_vislib/public/vislib/helpers/point_series/_get_point.test.ts
+++ b/src/plugins/vis_type_vislib/public/vislib/helpers/point_series/_get_point.test.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { IFieldFormatsRegistry } from '../../../../../data/common';
+import { IFieldFormatsRegistry } from '../../../../../field_formats/common';
 
 import { getPoint } from './_get_point';
 import { setFormatService } from '../../../services';
diff --git a/src/plugins/vis_type_vislib/public/vislib/visualizations/gauges/meter.js b/src/plugins/vis_type_vislib/public/vislib/visualizations/gauges/meter.js
index b7f5b966a08c67..65f7df6459bfe2 100644
--- a/src/plugins/vis_type_vislib/public/vislib/visualizations/gauges/meter.js
+++ b/src/plugins/vis_type_vislib/public/vislib/visualizations/gauges/meter.js
@@ -10,7 +10,7 @@ import d3 from 'd3';
 import _ from 'lodash';
 
 import { getHeatmapColors } from '../../../../../charts/public';
-import { UI_SETTINGS } from '../../../../../data/public';
+import { FORMATS_UI_SETTINGS } from '../../../../../field_formats/common';
 import { getValueForPercentageMode } from '../../percentage_mode_transform';
 
 const arcAngles = {
@@ -73,7 +73,7 @@ export class MeterGauge {
     const isPercentageMode = this.gaugeConfig.percentageMode;
     const percentageFormatPattern =
       this.gaugeConfig.percentageFormatPattern ||
-      this.uiSettings.get(UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN);
+      this.uiSettings.get(FORMATS_UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN);
     const colorsRange = this.gaugeConfig.colorsRange;
     const max = _.last(colorsRange).to;
     const labels = [];
diff --git a/src/plugins/vis_type_vislib/public/vislib/visualizations/point_series/heatmap_chart.js b/src/plugins/vis_type_vislib/public/vislib/visualizations/point_series/heatmap_chart.js
index 0dc1e18270f78e..a25d4087692733 100644
--- a/src/plugins/vis_type_vislib/public/vislib/visualizations/point_series/heatmap_chart.js
+++ b/src/plugins/vis_type_vislib/public/vislib/visualizations/point_series/heatmap_chart.js
@@ -13,7 +13,7 @@ import { isColorDark } from '@elastic/eui';
 
 import { PointSeries } from './_point_series';
 import { getHeatmapColors } from '../../../../../../plugins/charts/public';
-import { UI_SETTINGS } from '../../../../../../plugins/data/public';
+import { FORMATS_UI_SETTINGS } from '../../../../../../plugins/field_formats/common';
 import { getValueForPercentageMode } from '../../percentage_mode_transform';
 
 const defaults = {
@@ -54,7 +54,7 @@ export class HeatmapChart extends PointSeries {
     const percentageMode = cfg.get('percentageMode');
     const percentageFormatPattern = cfg.get(
       'percentageFormatPattern',
-      this.uiSettings.get(UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN)
+      this.uiSettings.get(FORMATS_UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN)
     );
     const colorsNumber = cfg.get('colorsNumber');
     const colorsRange = cfg.get('colorsRange');
diff --git a/src/plugins/vis_type_xy/public/components/xy_settings.tsx b/src/plugins/vis_type_xy/public/components/xy_settings.tsx
index 6d1425f488a47a..03455bae695061 100644
--- a/src/plugins/vis_type_xy/public/components/xy_settings.tsx
+++ b/src/plugins/vis_type_xy/public/components/xy_settings.tsx
@@ -11,6 +11,7 @@ import React, { FC } from 'react';
 import {
   Direction,
   Settings,
+  SettingsSpecProps,
   DomainRange,
   Position,
   PartialTheme,
@@ -49,6 +50,7 @@ type XYSettingsProps = Pick<
   | 'xAxis'
   | 'orderBucketsBySum'
 > & {
+  onPointerUpdate: SettingsSpecProps['onPointerUpdate'];
   xDomain?: DomainRange;
   adjustedXDomain?: DomainRange;
   showLegend: boolean;
@@ -85,6 +87,7 @@ export const XYSettings: FC<XYSettingsProps> = ({
   adjustedXDomain,
   showLegend,
   onElementClick,
+  onPointerUpdate,
   onBrushEnd,
   onRenderChange,
   legendAction,
@@ -107,6 +110,9 @@ export const XYSettings: FC<XYSettingsProps> = ({
     barSeriesStyle: {
       ...valueLabelsStyling,
     },
+    crosshair: {
+      ...theme.crosshair,
+    },
     axes: {
       axisTitle: {
         padding: {
@@ -152,6 +158,7 @@ export const XYSettings: FC<XYSettingsProps> = ({
   return (
     <Settings
       debugState={window._echDebugStateFlag ?? false}
+      onPointerUpdate={onPointerUpdate}
       xDomain={adjustedXDomain}
       rotation={rotation}
       theme={[themeOverrides, theme]}
diff --git a/src/plugins/vis_type_xy/public/plugin.ts b/src/plugins/vis_type_xy/public/plugin.ts
index 9e1e7354c8a69e..488e6fd84b4dac 100644
--- a/src/plugins/vis_type_xy/public/plugin.ts
+++ b/src/plugins/vis_type_xy/public/plugin.ts
@@ -9,7 +9,7 @@
 import { CoreSetup, CoreStart, Plugin } from '../../../core/public';
 import { Plugin as ExpressionsPublicPlugin } from '../../expressions/public';
 import { VisualizationsSetup, VisualizationsStart } from '../../visualizations/public';
-import { ChartsPluginSetup } from '../../charts/public';
+import { ChartsPluginSetup, ChartsPluginStart } from '../../charts/public';
 import { DataPublicPluginStart } from '../../data/public';
 import { UsageCollectionSetup } from '../../usage_collection/public';
 import {
@@ -20,6 +20,7 @@ import {
   setDocLinks,
   setPalettesService,
   setTrackUiMetric,
+  setActiveCursor,
 } from './services';
 
 import { visTypesDefinitions } from './vis_types';
@@ -46,6 +47,7 @@ export interface VisTypeXyPluginStartDependencies {
   expressions: ReturnType<ExpressionsPublicPlugin['start']>;
   visualizations: VisualizationsStart;
   data: DataPublicPluginStart;
+  charts: ChartsPluginStart;
 }
 
 type VisTypeXyCoreSetup = CoreSetup<VisTypeXyPluginStartDependencies, VisTypeXyPluginStart>;
@@ -86,11 +88,11 @@ export class VisTypeXyPlugin
     return {};
   }
 
-  public start(core: CoreStart, { data }: VisTypeXyPluginStartDependencies) {
+  public start(core: CoreStart, { data, charts }: VisTypeXyPluginStartDependencies) {
     setFormatService(data.fieldFormats);
     setDataActions(data.actions);
     setDocLinks(core.docLinks);
-
+    setActiveCursor(charts.activeCursor);
     return {};
   }
 }
diff --git a/src/plugins/vis_type_xy/public/services.ts b/src/plugins/vis_type_xy/public/services.ts
index b5dd6152605dcd..63bc55b288ae3a 100644
--- a/src/plugins/vis_type_xy/public/services.ts
+++ b/src/plugins/vis_type_xy/public/services.ts
@@ -10,7 +10,7 @@ import { UiCounterMetricType } from '@kbn/analytics';
 import { CoreSetup, DocLinksStart } from '../../../core/public';
 import { createGetterSetter } from '../../kibana_utils/public';
 import { DataPublicPluginStart } from '../../data/public';
-import { ChartsPluginSetup } from '../../charts/public';
+import { ChartsPluginSetup, ChartsPluginStart } from '../../charts/public';
 
 export const [getUISettings, setUISettings] = createGetterSetter<CoreSetup['uiSettings']>(
   'xy core.uiSettings'
@@ -28,6 +28,10 @@ export const [getThemeService, setThemeService] = createGetterSetter<ChartsPlugi
   'xy charts.theme'
 );
 
+export const [getActiveCursor, setActiveCursor] = createGetterSetter<
+  ChartsPluginStart['activeCursor']
+>('xy charts.activeCursor');
+
 export const [getPalettesService, setPalettesService] = createGetterSetter<
   ChartsPluginSetup['palettes']
 >('xy charts.palette');
diff --git a/src/plugins/vis_type_xy/public/vis_component.tsx b/src/plugins/vis_type_xy/public/vis_component.tsx
index dd88822f7f0f36..2dffabb2ba0b9c 100644
--- a/src/plugins/vis_type_xy/public/vis_component.tsx
+++ b/src/plugins/vis_type_xy/public/vis_component.tsx
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import React, { memo, useCallback, useEffect, useMemo, useState } from 'react';
+import React, { memo, useCallback, useEffect, useMemo, useRef, useState } from 'react';
 
 import {
   Chart,
@@ -32,7 +32,7 @@ import {
 } from '../../charts/public';
 import { Datatable, IInterpreterRenderHandlers } from '../../expressions/public';
 import type { PersistedState } from '../../visualizations/public';
-
+import { useActiveCursor } from '../../charts/public';
 import { VisParams } from './types';
 import {
   getAdjustedDomain,
@@ -47,7 +47,7 @@ import {
 } from './utils';
 import { XYAxis, XYEndzones, XYCurrentTime, XYSettings, XYThresholdLine } from './components';
 import { getConfig } from './config';
-import { getThemeService, getDataActions, getPalettesService } from './services';
+import { getThemeService, getDataActions, getPalettesService, getActiveCursor } from './services';
 import { ChartType } from '../common';
 
 import './_chart.scss';
@@ -77,6 +77,11 @@ const VisComponent = (props: VisComponentProps) => {
     return props.uiState?.get('vis.legendOpen', bwcLegendStateDefault) as boolean;
   });
   const [palettesRegistry, setPalettesRegistry] = useState<PaletteRegistry | null>(null);
+  const chartRef = useRef<Chart>(null);
+
+  const handleCursorUpdate = useActiveCursor(getActiveCursor(), chartRef, {
+    datatables: [props.visData],
+  });
 
   const onRenderChange = useCallback<RenderChangeListener>(
     (isRendered) => {
@@ -333,7 +338,7 @@ const VisComponent = (props: VisComponentProps) => {
         showLegend={showLegend}
         legendPosition={legendPosition}
       />
-      <Chart size="100%">
+      <Chart size="100%" ref={chartRef}>
         <ChartSplitter
           splitColumnAccessor={splitChartColumnAccessor}
           splitRowAccessor={splitChartRowAccessor}
@@ -341,6 +346,7 @@ const VisComponent = (props: VisComponentProps) => {
         <XYSettings
           {...config}
           showLegend={showLegend}
+          onPointerUpdate={handleCursorUpdate}
           legendPosition={legendPosition}
           xDomain={xDomain}
           adjustedXDomain={adjustedXDomain}
diff --git a/src/setup_node_env/exit_on_warning.js b/src/setup_node_env/exit_on_warning.js
index 9a6e608b53f0f4..5fbee027080836 100644
--- a/src/setup_node_env/exit_on_warning.js
+++ b/src/setup_node_env/exit_on_warning.js
@@ -29,6 +29,14 @@ var IGNORE_WARNINGS = [
     file: '/node_modules/supertest/node_modules/superagent/lib/node/index.js',
     line: 418,
   },
+  {
+    // TODO: @elastic/es-clients - The new client will attempt a Product check and it will `process.emitWarning`
+    //  that the security features are blocking such check.
+    //  Such emit is causing Node.js to crash unless we explicitly catch it.
+    //  We need to discard that warning
+    message:
+      'The client is unable to verify that the server is Elasticsearch due to security privileges on the server side. Some functionality may not be compatible if the server is running an unsupported product.',
+  },
 ];
 
 if (process.noProcessWarnings !== true) {
diff --git a/test/accessibility/apps/management.ts b/test/accessibility/apps/management.ts
index 7a99e5832448fd..538755b482fbff 100644
--- a/test/accessibility/apps/management.ts
+++ b/test/accessibility/apps/management.ts
@@ -70,6 +70,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.settings.clickAddNewIndexPatternButton();
       await PageObjects.header.waitUntilLoadingHasFinished();
       await a11y.testAppSnapshot();
+      await testSubjects.click('closeFlyoutButton');
     });
 
     // We are navigating back to index pattern page to test field formatters
diff --git a/test/api_integration/apis/suggestions/suggestions.js b/test/api_integration/apis/suggestions/suggestions.js
index ca43641d881cdf..ea8da57eda0654 100644
--- a/test/api_integration/apis/suggestions/suggestions.js
+++ b/test/api_integration/apis/suggestions/suggestions.js
@@ -5,6 +5,7 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
+import expect from '@kbn/expect';
 
 export default function ({ getService }) {
   const esArchiver = getService('esArchiver');
@@ -12,46 +13,227 @@ export default function ({ getService }) {
   const supertest = getService('supertest');
 
   describe('Suggestions API', function () {
-    before(async () => {
-      await esArchiver.load('test/api_integration/fixtures/es_archiver/index_patterns/basic_index');
-      await kibanaServer.importExport.load(
-        'test/api_integration/fixtures/kbn_archiver/index_patterns/basic_kibana.json'
-      );
-    });
-    after(async () => {
-      await esArchiver.unload(
-        'test/api_integration/fixtures/es_archiver/index_patterns/basic_index'
-      );
-      await kibanaServer.importExport.unload(
-        'test/api_integration/fixtures/kbn_archiver/index_patterns/basic_kibana.json'
-      );
+    describe('non time based', () => {
+      before(async () => {
+        await esArchiver.load(
+          'test/api_integration/fixtures/es_archiver/index_patterns/basic_index'
+        );
+        await kibanaServer.importExport.load(
+          'test/api_integration/fixtures/kbn_archiver/index_patterns/basic_kibana.json'
+        );
+      });
+      after(async () => {
+        await esArchiver.unload(
+          'test/api_integration/fixtures/es_archiver/index_patterns/basic_index'
+        );
+        await kibanaServer.importExport.unload(
+          'test/api_integration/fixtures/kbn_archiver/index_patterns/basic_kibana.json'
+        );
+      });
+      it('should return 200 without a query', () =>
+        supertest
+          .post('/api/kibana/suggestions/values/basic_index')
+          .send({
+            field: 'baz.keyword',
+            query: '',
+          })
+          .expect(200)
+          .then(({ body }) => {
+            expect(body).to.have.length(1);
+            expect(body).to.contain('hello');
+          }));
+
+      it('should return 200 without a query and with method set to terms_agg', () =>
+        supertest
+          .post('/api/kibana/suggestions/values/basic_index')
+          .send({
+            field: 'baz.keyword',
+            method: 'terms_agg',
+            query: '',
+          })
+          .expect(200)
+          .then(({ body }) => {
+            expect(body).to.have.length(1);
+            expect(body).to.contain('hello');
+          }));
+
+      it('should return 200 without a query and with method set to terms_enum', () =>
+        supertest
+          .post('/api/kibana/suggestions/values/basic_index')
+          .send({
+            field: 'baz.keyword',
+            method: 'terms_enum',
+            query: '',
+          })
+          .expect(200)
+          .then(({ body }) => {
+            expect(body).to.have.length(1);
+            expect(body).to.contain('hello');
+          }));
+
+      it('should return 200 with special characters', () =>
+        supertest
+          .post('/api/kibana/suggestions/values/basic_index')
+          .send({
+            field: 'baz.keyword',
+            query: '<something?with:lots&of^ bad characters',
+          })
+          .expect(200)
+          .then(({ body }) => {
+            expect(body).to.be.empty();
+          }));
+
+      it('should support nested fields', () =>
+        supertest
+          .post('/api/kibana/suggestions/values/basic_index')
+          .send({
+            field: 'nestedField.child',
+            query: 'nes',
+          })
+          .expect(200, ['nestedValue']));
+
+      it('should return 404 if index is not found', () =>
+        supertest
+          .post('/api/kibana/suggestions/values/not_found')
+          .send({
+            field: 'baz.keyword',
+            query: '1',
+          })
+          .expect(404));
+
+      it('should return 400 without a query', () =>
+        supertest
+          .post('/api/kibana/suggestions/values/basic_index')
+          .send({
+            field: 'baz.keyword',
+          })
+          .expect(400));
+
+      it('should return 400 with a bad method', () =>
+        supertest
+          .post('/api/kibana/suggestions/values/basic_index')
+          .send({
+            field: 'baz.keyword',
+            query: '',
+            method: 'cookie',
+          })
+          .expect(400));
     });
 
-    it('should return 200 with special characters', () =>
-      supertest
-        .post('/api/kibana/suggestions/values/basic_index')
-        .send({
-          field: 'baz.keyword',
-          query: '<something?with:lots&of^ bad characters',
-        })
-        .expect(200));
-
-    it('should support nested fields', () =>
-      supertest
-        .post('/api/kibana/suggestions/values/basic_index')
-        .send({
-          field: 'nestedField.child',
-          query: 'nes',
-        })
-        .expect(200, ['nestedValue']));
-
-    it('should return 404 if index is not found', () =>
-      supertest
-        .post('/api/kibana/suggestions/values/not_found')
-        .send({
-          field: 'baz.keyword',
-          query: '1',
-        })
-        .expect(404));
+    describe('time based', () => {
+      before(async () => {
+        await esArchiver.loadIfNeeded('test/functional/fixtures/es_archiver/logstash_functional');
+        await kibanaServer.importExport.load(
+          'test/api_integration/fixtures/kbn_archiver/saved_objects/basic.json'
+        );
+      });
+
+      after(async () => {
+        await esArchiver.unload('test/functional/fixtures/es_archiver/logstash_functional');
+
+        await kibanaServer.importExport.unload(
+          'test/api_integration/fixtures/kbn_archiver/saved_objects/basic.json'
+        );
+      });
+
+      it('filter is applied on a document level with terms_agg', () =>
+        supertest
+          .post('/api/kibana/suggestions/values/logstash-*')
+          .send({
+            field: 'extension.raw',
+            query: '',
+            method: 'terms_agg',
+            filters: [
+              {
+                range: {
+                  '@timestamp': {
+                    gte: '2015-09-19T23:43:00.000Z',
+                    lte: '2015-09-20T00:25:00.000Z',
+                    format: 'strict_date_optional_time',
+                  },
+                },
+              },
+            ],
+          })
+          .expect(200)
+          .then(({ body }) => {
+            expect(body).to.have.length(1);
+            expect(body).to.contain('jpg');
+          }));
+
+      it('filter returns all results because it was applied on an index level with terms_enum', () =>
+        supertest
+          .post('/api/kibana/suggestions/values/logstash-*')
+          .send({
+            field: 'extension.raw',
+            query: '',
+            method: 'terms_enum',
+            filters: [
+              {
+                range: {
+                  '@timestamp': {
+                    gte: '2015-09-19T23:43:00.000Z',
+                    lte: '2015-09-20T00:25:00.000Z',
+                    format: 'strict_date_optional_time',
+                  },
+                },
+              },
+            ],
+          })
+          .expect(200)
+          .then(({ body }) => {
+            // All indices have
+            expect(body).to.have.length(5);
+          }));
+
+      it('filter is applied on an index level with terms_enum - find in range', () =>
+        supertest
+          .post('/api/kibana/suggestions/values/logstash-*')
+          .send({
+            field: 'request.raw',
+            query: '/uploads/anatoly-art',
+            method: 'terms_enum',
+            filters: [
+              {
+                range: {
+                  '@timestamp': {
+                    gte: '2015-09-22T00:00:00.000Z',
+                    lte: '2015-09-23T00:00:00.000Z',
+                    format: 'strict_date_optional_time',
+                  },
+                },
+              },
+            ],
+          })
+          .expect(200)
+          .then(({ body }) => {
+            expect(body).to.have.length(2);
+          }));
+
+      it('filter is applied on an index level with terms_enum - DONT find in range', () => {
+        supertest
+          .post('/api/kibana/suggestions/values/logstash-*')
+          .send({
+            field: 'request.raw',
+            query: '/uploads/anatoly-art',
+            method: 'terms_enum',
+            filters: [
+              {
+                range: {
+                  '@timestamp': {
+                    gte: '2015-09-23T00:00:00.000Z',
+                    lte: '2015-09-24T00:00:00.000Z',
+                    format: 'strict_date_optional_time',
+                  },
+                },
+              },
+            ],
+          })
+          .expect(200)
+          .then(({ body }) => {
+            expect(body).to.have.length(0);
+          });
+      });
+    });
   });
 }
diff --git a/test/common/config.js b/test/common/config.js
index 84848347f94cda..5b5d01cfeb1e4f 100644
--- a/test/common/config.js
+++ b/test/common/config.js
@@ -48,8 +48,7 @@ export default function () {
         '--telemetry.banner=false',
         '--telemetry.optIn=false',
         // These are *very* important to have them pointing to staging
-        '--telemetry.url=https://telemetry-staging.elastic.co/xpack/v2/send',
-        '--telemetry.optInStatusUrl=https://telemetry-staging.elastic.co/opt_in_status/v2/send',
+        '--telemetry.sendUsageTo=staging',
         `--server.maxPayload=1679958`,
         // newsfeed mock service
         `--plugin-path=${path.join(__dirname, 'fixtures', 'plugins', 'newsfeed')}`,
diff --git a/test/functional/apps/dashboard/url_field_formatter.ts b/test/functional/apps/dashboard/url_field_formatter.ts
index 8a4371a0adf774..254d71294d8c70 100644
--- a/test/functional/apps/dashboard/url_field_formatter.ts
+++ b/test/functional/apps/dashboard/url_field_formatter.ts
@@ -36,8 +36,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     expect(currentUrl).to.equal(fieldUrl);
   };
 
-  // FLAKY: https://github.com/elastic/kibana/issues/79463
-  describe.skip('Changing field formatter to Url', () => {
+  describe('Changing field formatter to Url', () => {
     before(async function () {
       await esArchiver.load('test/functional/fixtures/es_archiver/dashboard/current/kibana');
       await kibanaServer.uiSettings.replace({
@@ -48,13 +47,14 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await settings.clickIndexPatternLogstash();
       await settings.filterField(fieldName);
       await settings.openControlsByName(fieldName);
+      await settings.toggleRow('formatRow');
       await settings.setFieldFormat('url');
       await settings.controlChangeSave();
     });
 
     it('applied on dashboard', async () => {
       await common.navigateToApp('dashboard');
-      await dashboard.loadSavedDashboard('dashboard with everything');
+      await dashboard.loadSavedDashboard('dashboard with table');
       await dashboard.waitForRenderComplete();
       const fieldLink = await visChart.getFieldLinkInVisTable(`${fieldName}: Descending`, 1);
       await clickFieldAndCheckUrl(fieldLink);
diff --git a/test/functional/apps/management/_create_index_pattern_wizard.js b/test/functional/apps/management/_create_index_pattern_wizard.js
index d4b49d74d1b901..b2f24e530cb120 100644
--- a/test/functional/apps/management/_create_index_pattern_wizard.js
+++ b/test/functional/apps/management/_create_index_pattern_wizard.js
@@ -6,8 +6,6 @@
  * Side Public License, v 1.
  */
 
-import expect from '@kbn/expect';
-
 export default function ({ getService, getPageObjects }) {
   const kibanaServer = getService('kibanaServer');
   const testSubjects = getService('testSubjects');
@@ -23,23 +21,6 @@ export default function ({ getService, getPageObjects }) {
       await PageObjects.settings.clickKibanaIndexPatterns();
     });
 
-    describe('step 1 next button', function () {
-      it('is disabled by default', async function () {
-        await (await testSubjects.find('createIndexPatternButton')).click();
-        const btn = await PageObjects.settings.getCreateIndexPatternGoToStep2Button();
-        const isEnabled = await btn.isEnabled();
-        expect(isEnabled).not.to.be.ok();
-      });
-
-      it('is enabled once an index pattern with matching indices has been entered', async function () {
-        await PageObjects.settings.setIndexPatternField();
-        await PageObjects.common.sleep(1000);
-        const btn = await PageObjects.settings.getCreateIndexPatternGoToStep2Button();
-        const isEnabled = await btn.isEnabled();
-        expect(isEnabled).to.be.ok();
-      });
-    });
-
     describe('index alias', () => {
       before(async function () {
         await security.testUser.setRoles(['kibana_admin', 'test_alias1_reader']);
diff --git a/test/functional/apps/management/_index_pattern_create_delete.js b/test/functional/apps/management/_index_pattern_create_delete.js
index b195e4c8d58575..eff55b695d5b47 100644
--- a/test/functional/apps/management/_index_pattern_create_delete.js
+++ b/test/functional/apps/management/_index_pattern_create_delete.js
@@ -14,6 +14,7 @@ export default function ({ getService, getPageObjects }) {
   const log = getService('log');
   const retry = getService('retry');
   const testSubjects = getService('testSubjects');
+  const find = getService('find');
   const PageObjects = getPageObjects(['settings', 'common', 'header']);
 
   describe('creating and deleting default index', function describeIndexTests() {
@@ -29,6 +30,31 @@ export default function ({ getService, getPageObjects }) {
         });
     });
 
+    describe('can open and close editor', function () {
+      it('without creating index pattern', async function () {
+        await PageObjects.settings.clickKibanaIndexPatterns();
+        await PageObjects.settings.clickAddNewIndexPatternButton();
+        await testSubjects.click('closeFlyoutButton');
+        await testSubjects.find('createIndexPatternButton');
+      });
+    });
+
+    // FLAKY: https://github.com/elastic/kibana/issues/107831
+    describe.skip('validation', function () {
+      it('can display errors', async function () {
+        await PageObjects.settings.clickAddNewIndexPatternButton();
+        await PageObjects.settings.setIndexPatternField('log*');
+        await (await PageObjects.settings.getSaveIndexPatternButton()).click();
+        await find.byClassName('euiFormErrorText');
+      });
+
+      it('can resolve errors and submit', async function () {
+        await PageObjects.settings.selectTimeFieldOption('@timestamp');
+        await (await PageObjects.settings.getSaveIndexPatternButton()).click();
+        await PageObjects.settings.removeIndexPattern();
+      });
+    });
+
     describe('special character handling', () => {
       it('should handle special charaters in template input', async () => {
         await PageObjects.settings.clickAddNewIndexPatternButton();
diff --git a/test/functional/apps/visualize/_linked_saved_searches.ts b/test/functional/apps/visualize/_linked_saved_searches.ts
index cfb20cf4b59b8a..6fa8acac8e7819 100644
--- a/test/functional/apps/visualize/_linked_saved_searches.ts
+++ b/test/functional/apps/visualize/_linked_saved_searches.ts
@@ -32,6 +32,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       before(async () => {
         await PageObjects.visualize.initTests();
         await PageObjects.common.navigateToApp('discover');
+        await PageObjects.timePicker.setDefaultAbsoluteRange();
         await filterBar.addFilter('extension.raw', 'is', 'jpg');
         await PageObjects.header.waitUntilLoadingHasFinished();
         await PageObjects.discover.saveSearch(savedSearchName);
diff --git a/test/functional/apps/visualize/_point_series_options.ts b/test/functional/apps/visualize/_point_series_options.ts
index ee64fdf7ddda3b..08c26b1f3ee952 100644
--- a/test/functional/apps/visualize/_point_series_options.ts
+++ b/test/functional/apps/visualize/_point_series_options.ts
@@ -151,7 +151,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       });
 
       it('should put secondary axis on the right', async function () {
-        const length = await PageObjects.visChart.getRightValueAxesCount();
+        const length = await PageObjects.visChart.getAxesCountByPosition('right');
         expect(length).to.be(1);
       });
     });
diff --git a/test/functional/apps/visualize/_timelion.ts b/test/functional/apps/visualize/_timelion.ts
new file mode 100644
index 00000000000000..589559c7178427
--- /dev/null
+++ b/test/functional/apps/visualize/_timelion.ts
@@ -0,0 +1,206 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import expect from '@kbn/expect';
+
+import type { FtrProviderContext } from '../../ftr_provider_context';
+
+export default function ({ getPageObjects, getService }: FtrProviderContext) {
+  const { timePicker, visChart, visEditor, visualize } = getPageObjects([
+    'timePicker',
+    'visChart',
+    'visEditor',
+    'visualize',
+  ]);
+  const monacoEditor = getService('monacoEditor');
+  const kibanaServer = getService('kibanaServer');
+  const elasticChart = getService('elasticChart');
+  const find = getService('find');
+
+  describe('Timelion visualization', () => {
+    before(async () => {
+      await kibanaServer.uiSettings.update({
+        'timelion:legacyChartsLibrary': false,
+      });
+      await visualize.initTests(true);
+      await visualize.navigateToNewAggBasedVisualization();
+      await visualize.clickTimelion();
+      await timePicker.setDefaultAbsoluteRange();
+    });
+
+    const initVisualization = async (expression: string, interval: string = '12h') => {
+      await visEditor.setTimelionInterval(interval);
+      await monacoEditor.setCodeEditorValue(expression);
+      await visEditor.clickGo();
+    };
+
+    it('should display correct data for specified index pattern and timefield', async () => {
+      await initVisualization('.es(index=long-window-logstash-*,timefield=@timestamp)');
+
+      const chartData = await visChart.getAreaChartData('q:* > count');
+      expect(chartData).to.eql([3, 5, 2, 6, 1, 6, 1, 7, 0, 0]);
+    });
+
+    it('should display correct chart colors for multiple expressions', async () => {
+      const expectedColors = ['#01A4A4', '#FFCFDF', '#BFA7DA', '#AD7DE6'];
+      await initVisualization(
+        '.es(*), .es(*).color("#FFCFDF"), .es(*).color("#BFA7DA"), .es(*).color("#AD7DE6")'
+      );
+
+      const areas = (await elasticChart.getChartDebugData())?.areas;
+      expect(areas?.map(({ color }) => color)).to.eql(expectedColors);
+    });
+
+    it('should display correct chart data for average, min, max and cardinality aggregations', async () => {
+      await initVisualization(
+        '.es(index=logstash-*,metric=avg:bytes), .es(index=logstash-*,metric=min:bytes),' +
+          '.es(index=logstash-*,metric=max:bytes,), .es(index=logstash-*,metric=cardinality:bytes)',
+        '36h'
+      );
+
+      const firstAreaChartData = await visChart.getAreaChartData('q:* > avg(bytes)');
+      const secondAreaChartData = await visChart.getAreaChartData('q:* > min(bytes)');
+      const thirdAreaChartData = await visChart.getAreaChartData('q:* > max(bytes)');
+      const forthAreaChartData = await visChart.getAreaChartData('q:* > cardinality(bytes)');
+
+      expect(firstAreaChartData).to.eql([5732.783676366217, 5721.775973559419]);
+      expect(secondAreaChartData).to.eql([0, 0]);
+      expect(thirdAreaChartData).to.eql([19985, 19986]);
+      expect(forthAreaChartData).to.eql([5019, 4958, 0, 0]);
+    });
+
+    it('should display correct chart data for expressions using functions', async () => {
+      const firstAreaExpectedChartData = [3, 2421, 2343, 2294, 2327, 2328, 2312, 7, 0, 0];
+      const thirdAreaExpectedChartData = [200, 167, 199, 200, 200, 198, 108, 200, 200];
+      const forthAreaExpectedChartData = [150, 50, 50, 50, 50, 50, 50, 150, 150, 150];
+      await initVisualization(
+        '.es(*).label("initial"),' +
+          '.es(*).add(term=.es(*).multiply(-1).abs()).divide(2).label("add multiply abs divide"),' +
+          '.es(q="bytes<100").derivative().sum(200).min(200).label("query derivative min sum"),' +
+          '.es(*).if(operator=gt,if=200,then=50,else=150).label("condition")'
+      );
+
+      const firstAreaChartData = await visChart.getAreaChartData('initial');
+      const secondAreaChartData = await visChart.getAreaChartData('add multiply abs divide');
+      const thirdAreaChartData = await visChart.getAreaChartData('query derivative min sum');
+      const forthAreaChartData = await visChart.getAreaChartData('condition');
+
+      expect(firstAreaChartData).to.eql(firstAreaExpectedChartData);
+      expect(secondAreaChartData).to.eql(firstAreaExpectedChartData);
+      expect(thirdAreaChartData).to.eql(thirdAreaExpectedChartData);
+      expect(forthAreaChartData).to.eql(forthAreaExpectedChartData);
+    });
+
+    it('should display correct chart title, data and labels for expressions with custom labels, yaxis and offset', async () => {
+      const firstAreaExpectedChartData = [13112352443.375292, 13095637741.055172];
+      const secondAreaExpectedChartData = [
+        [1442642400000, 5732.783676366217],
+        [1442772000000, 5721.775973559419],
+      ];
+      const thirdAreaExpectedChartData = [
+        [1442772000000, 5732.783676366217],
+        [1442901600000, 5721.775973559419],
+      ];
+      await initVisualization(
+        '.es(index=logstash*,timefield="@timestamp",metric=avg:machine.ram).label("Average Machine RAM amount").yaxis(2,units=bytes,position=right),' +
+          '.es(index=logstash*,timefield="@timestamp",metric=avg:bytes).label("Average Bytes for request").yaxis(1,units=bytes,position=left),' +
+          '.es(index=logstash*,timefield="@timestamp",metric=avg:bytes, offset=-12h).label("Average Bytes for request with offset").yaxis(3,units=custom:BYTES_,position=right)',
+        '36h'
+      );
+
+      const leftAxesCount = await visChart.getAxesCountByPosition('left');
+      const rightAxesCount = await visChart.getAxesCountByPosition('right');
+      const firstAxesLabels = await visChart.getYAxisLabels();
+      const secondAxesLabels = await visChart.getYAxisLabels(1);
+      const thirdAxesLabels = await visChart.getYAxisLabels(2);
+      const firstAreaChartData = await visChart.getAreaChartData('Average Machine RAM amount');
+      const secondAreaChartData = await visChart.getAreaChartData(
+        'Average Bytes for request',
+        undefined,
+        true
+      );
+      const thirdAreaChartData = await visChart.getAreaChartData(
+        'Average Bytes for request with offset',
+        undefined,
+        true
+      );
+
+      expect(leftAxesCount).to.be(1);
+      expect(rightAxesCount).to.be(2);
+      expect(firstAreaChartData).to.eql(firstAreaExpectedChartData);
+      expect(secondAreaChartData).to.eql(secondAreaExpectedChartData);
+      expect(thirdAreaChartData).to.eql(thirdAreaExpectedChartData);
+      expect(firstAxesLabels).to.eql(['12.19GB', '12.2GB', '12.21GB']);
+      expect(secondAxesLabels).to.eql(['5.59KB', '5.6KB']);
+      expect(thirdAxesLabels.toString()).to.be(
+        'BYTES_5721,BYTES_5722,BYTES_5723,BYTES_5724,BYTES_5725,BYTES_5726,BYTES_5727,BYTES_5728,BYTES_5729,BYTES_5730,BYTES_5731,BYTES_5732,BYTES_5733'
+      );
+    });
+
+    it('should display correct chart data for split expression', async () => {
+      await initVisualization('.es(index=logstash-*, split=geo.dest:3)', '1 day');
+
+      const firstAreaChartData = await visChart.getAreaChartData('q:* > geo.dest:CN > count');
+      const secondAreaChartData = await visChart.getAreaChartData('q:* > geo.dest:IN > count');
+      const thirdAreaChartData = await visChart.getAreaChartData('q:* > geo.dest:US > count');
+
+      expect(firstAreaChartData).to.eql([0, 905, 910, 850, 0]);
+      expect(secondAreaChartData).to.eql([0, 763, 699, 825, 0]);
+      expect(thirdAreaChartData).to.eql([0, 423, 386, 389, 0]);
+    });
+
+    it('should display two areas and one bar chart items', async () => {
+      await initVisualization('.es(*), .es(*), .es(*).bars(stack=true)');
+
+      const areasChartsCount = await visChart.getAreaSeriesCount();
+      const barsChartsCount = await visChart.getHistogramSeriesCount();
+
+      expect(areasChartsCount).to.be(2);
+      expect(barsChartsCount).to.be(1);
+    });
+
+    describe('Legend', () => {
+      it('should correctly display the legend items names and position', async () => {
+        await initVisualization('.es(*).label("first series"), .es(*).label("second series")');
+
+        const legendNames = await visChart.getLegendEntries();
+        const legendElement = await find.byClassName('echLegend');
+        const isLegendTopPositioned = await legendElement.elementHasClass('echLegend--top');
+        const isLegendLeftPositioned = await legendElement.elementHasClass('echLegend--left');
+
+        expect(legendNames).to.eql(['first series', 'second series']);
+        expect(isLegendTopPositioned).to.be(true);
+        expect(isLegendLeftPositioned).to.be(true);
+      });
+
+      it('should correctly display the legend position', async () => {
+        await initVisualization('.es(*).legend(position=se)');
+
+        const legendElement = await find.byClassName('echLegend');
+        const isLegendBottomPositioned = await legendElement.elementHasClass('echLegend--bottom');
+        const isLegendRightPositioned = await legendElement.elementHasClass('echLegend--right');
+
+        expect(isLegendBottomPositioned).to.be(true);
+        expect(isLegendRightPositioned).to.be(true);
+      });
+
+      it('should not display the legend', async () => {
+        await initVisualization('.es(*), .es(*).label("second series").legend(position=false)');
+
+        const isLegendElementExists = await find.existsByCssSelector('.echLegend');
+        expect(isLegendElementExists).to.be(false);
+      });
+    });
+
+    after(
+      async () =>
+        await kibanaServer.uiSettings.update({
+          'timelion:legacyChartsLibrary': true,
+        })
+    );
+  });
+}
diff --git a/test/functional/apps/visualize/_tsvb_time_series.ts b/test/functional/apps/visualize/_tsvb_time_series.ts
index df6a879f5a0a92..e3d4fd989c7531 100644
--- a/test/functional/apps/visualize/_tsvb_time_series.ts
+++ b/test/functional/apps/visualize/_tsvb_time_series.ts
@@ -172,7 +172,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
           // click on specific coordinates
           await browser
             .getActions()
-            .move({ x: 100, y: 110, origin: el._webElement })
+            .move({ x: 105, y: 110, origin: el._webElement })
             .click()
             .perform();
 
diff --git a/test/functional/apps/visualize/index.ts b/test/functional/apps/visualize/index.ts
index bc6160eba38468..4af871bd9347dd 100644
--- a/test/functional/apps/visualize/index.ts
+++ b/test/functional/apps/visualize/index.ts
@@ -52,6 +52,7 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
       loadTestFile(require.resolve('./_vertical_bar_chart'));
       loadTestFile(require.resolve('./_vertical_bar_chart_nontimeindex'));
       loadTestFile(require.resolve('./_pie_chart'));
+      loadTestFile(require.resolve('./_timelion'));
     });
 
     describe('visualize ciGroup9', function () {
diff --git a/test/functional/apps/visualize/legacy/index.ts b/test/functional/apps/visualize/legacy/index.ts
index d474287860b25e..37cf8a59505927 100644
--- a/test/functional/apps/visualize/legacy/index.ts
+++ b/test/functional/apps/visualize/legacy/index.ts
@@ -7,7 +7,7 @@
  */
 
 import { FtrProviderContext } from '../../../ftr_provider_context';
-import { UI_SETTINGS } from '../../../../../src/plugins/data/common';
+import { FORMATS_UI_SETTINGS } from '../../../../../src/plugins/field_formats/common';
 
 export default function ({ getPageObjects, getService, loadTestFile }: FtrProviderContext) {
   const browser = getService('browser');
@@ -26,7 +26,7 @@ export default function ({ getPageObjects, getService, loadTestFile }: FtrProvid
       await kibanaServer.importExport.load('test/functional/fixtures/kbn_archiver/visualize.json');
       await kibanaServer.uiSettings.replace({
         defaultIndex: 'logstash-*',
-        [UI_SETTINGS.FORMAT_BYTES_DEFAULT_PATTERN]: '0,0.[000]b',
+        [FORMATS_UI_SETTINGS.FORMAT_BYTES_DEFAULT_PATTERN]: '0,0.[000]b',
       });
     });
 
diff --git a/test/functional/fixtures/es_archiver/dashboard/current/kibana/data.json b/test/functional/fixtures/es_archiver/dashboard/current/kibana/data.json
index 139da89e58d128..599ffbadaaea77 100644
--- a/test/functional/fixtures/es_archiver/dashboard/current/kibana/data.json
+++ b/test/functional/fixtures/es_archiver/dashboard/current/kibana/data.json
@@ -1135,6 +1135,49 @@
   }
 }
 
+{
+  "type": "doc",
+  "value": {
+    "id": "dashboard:d2525040-3dcd-11e8-8660-4d65aa086b3b",
+    "index": ".kibana",
+    "source": {
+      "coreMigrationVersion": "7.14.0",
+      "dashboard": {
+        "description": "I have one of every visualization type since the last time I was created!",
+        "hits": 0,
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[],\"highlightAll\":true,\"version\":true}"
+        },
+        "optionsJSON": "{\"darkTheme\":false,\"hidePanelTitles\":false,\"useMargins\":true}",
+        "panelsJSON": "[{\"version\":\"7.3.0\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":15,\"w\":24,\"h\":15,\"i\":\"3\"},\"panelIndex\":\"3\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_3\"}]",
+        "refreshInterval": {
+          "display": "Off",
+          "pause": false,
+          "value": 0
+        },
+        "timeFrom": "Mon Apr 09 2018 17:56:08 GMT-0400",
+        "timeRestore": true,
+        "timeTo": "Wed Apr 11 2018 17:56:08 GMT-0400",
+        "title": "dashboard with table",
+        "version": 1
+      },
+      "migrationVersion": {
+        "dashboard": "7.14.0"
+      },
+      "references": [
+        {
+          "id": "4b5d6ef0-3dcb-11e8-8660-4d65aa086b3c",
+          "name": "3:panel_3",
+          "type": "visualization"
+        }
+      ],
+      "type": "dashboard",
+      "updated_at": "2018-04-16T16:05:02.915Z"
+    },
+    "type": "_doc"
+  }
+}
+
 {
   "type": "doc",
   "value": {
@@ -3468,4 +3511,4 @@
     },
     "type": "_doc"
   }
-}
\ No newline at end of file
+}
diff --git a/test/functional/page_objects/settings_page.ts b/test/functional/page_objects/settings_page.ts
index cb8f1981770174..ab581beeb8b3b5 100644
--- a/test/functional/page_objects/settings_page.ts
+++ b/test/functional/page_objects/settings_page.ts
@@ -43,7 +43,10 @@ export class SettingsPageObject extends FtrService {
 
   async clickKibanaIndexPatterns() {
     this.log.debug('clickKibanaIndexPatterns link');
-    await this.testSubjects.click('indexPatterns');
+    const currentUrl = await this.browser.getCurrentUrl();
+    if (!currentUrl.endsWith('indexPatterns')) {
+      await this.testSubjects.click('indexPatterns');
+    }
 
     await this.header.waitUntilLoadingHasFinished();
   }
@@ -70,6 +73,14 @@ export class SettingsPageObject extends FtrService {
     );
   }
 
+  async getAdvancedSettingAriaCheckbox(propertyName: string) {
+    this.log.debug('in getAdvancedSettingAriaCheckbox');
+    return await this.testSubjects.getAttribute(
+      `advancedSetting-editField-${propertyName}`,
+      'aria-checked'
+    );
+  }
+
   async clearAdvancedSettings(propertyName: string) {
     await this.testSubjects.click(`advancedSetting-resetField-${propertyName}`);
     await this.header.waitUntilLoadingHasFinished();
@@ -110,7 +121,14 @@ export class SettingsPageObject extends FtrService {
     await this.header.waitUntilLoadingHasFinished();
   }
 
-  async toggleAdvancedSettingCheckbox(propertyName: string) {
+  async toggleAdvancedSettingCheckbox(propertyName: string, value?: boolean) {
+    let curValue: string | undefined;
+    if (value !== undefined) {
+      curValue = await this.getAdvancedSettingAriaCheckbox(propertyName);
+
+      if (curValue === (value ? 'true' : 'false')) return;
+    }
+
     await this.testSubjects.click(`advancedSetting-editField-${propertyName}`);
     await this.header.waitUntilLoadingHasFinished();
     await this.testSubjects.click(`advancedSetting-saveButton`);
@@ -122,38 +140,28 @@ export class SettingsPageObject extends FtrService {
   }
 
   async getIndexPatternField() {
-    return await this.testSubjects.find('createIndexPatternNameInput');
-  }
-
-  async clickTimeFieldNameField() {
-    return await this.testSubjects.click('createIndexPatternTimeFieldSelect');
+    return this.testSubjects.find('createIndexPatternNameInput');
   }
 
   async getTimeFieldNameField() {
-    return await this.testSubjects.find('createIndexPatternTimeFieldSelect');
+    const wrapperElement = await this.testSubjects.find('timestampField');
+    return wrapperElement.findByTestSubject('comboBoxSearchInput');
   }
 
   async selectTimeFieldOption(selection: string) {
     // open dropdown
-    await this.clickTimeFieldNameField();
-    // close dropdown, keep focus
-    await this.clickTimeFieldNameField();
-    await this.header.waitUntilLoadingHasFinished();
-    return await this.retry.try(async () => {
-      this.log.debug(`selectTimeFieldOption(${selection})`);
-      const timeFieldOption = await this.getTimeFieldOption(selection);
-      await timeFieldOption.click();
-      const selected = await timeFieldOption.isSelected();
-      if (!selected) throw new Error('option not selected: ' + selected);
-    });
+    const timefield = await this.getTimeFieldNameField();
+    await timefield.click();
+    await this.browser.pressKeys(selection);
+    await this.browser.pressKeys(this.browser.keys.TAB);
   }
 
   async getTimeFieldOption(selection: string) {
     return await this.find.displayedByCssSelector('option[value="' + selection + '"]');
   }
 
-  async getCreateIndexPatternButton() {
-    return await this.testSubjects.find('createIndexPatternButton');
+  async getSaveIndexPatternButton() {
+    return await this.testSubjects.find('saveIndexPatternButton');
   }
 
   async getCreateButton() {
@@ -350,25 +358,19 @@ export class SettingsPageObject extends FtrService {
 
       await this.header.waitUntilLoadingHasFinished();
       await this.clickAddNewIndexPatternButton();
+      await this.header.waitUntilLoadingHasFinished();
       if (!isStandardIndexPattern) {
-        await this.clickCreateNewRollupButton();
+        await this.selectRollupIndexPatternType();
       }
-      await this.header.waitUntilLoadingHasFinished();
       await this.retry.try(async () => {
         await this.setIndexPatternField(indexPatternName);
       });
 
-      const btn = await this.getCreateIndexPatternGoToStep2Button();
-      await this.retry.waitFor(`index pattern Go To Step 2 button to be enabled`, async () => {
-        return await btn.isEnabled();
-      });
-      await btn.click();
-
       await this.common.sleep(2000);
       if (timefield) {
         await this.selectTimeFieldOption(timefield);
       }
-      await (await this.getCreateIndexPatternButton()).click();
+      await (await this.getSaveIndexPatternButton()).click();
     });
     await this.header.waitUntilLoadingHasFinished();
     await this.retry.try(async () => {
@@ -381,16 +383,38 @@ export class SettingsPageObject extends FtrService {
       }
     });
 
+    if (!isStandardIndexPattern) {
+      const badges = await this.find.allByCssSelector('.euiBadge__text');
+      const text = await badges[1].getVisibleText();
+      expect(text).to.equal('Rollup');
+    }
+
     return await this.getIndexPatternIdFromUrl();
   }
 
   async clickAddNewIndexPatternButton() {
     await this.common.scrollKibanaBodyTop();
-    await this.testSubjects.click('createIndexPatternButton');
+
+    // if flyout is open
+    const flyoutView = await this.testSubjects.exists('createIndexPatternButtonFlyout');
+    if (flyoutView) {
+      await this.testSubjects.click('createIndexPatternButtonFlyout');
+      return;
+    }
+
+    const tableView = await this.testSubjects.exists('createIndexPatternButton');
+    if (tableView) {
+      await this.testSubjects.click('createIndexPatternButton');
+    }
+    const flyoutView2 = await this.testSubjects.exists('createIndexPatternButtonFlyout');
+    if (flyoutView2) {
+      await this.testSubjects.click('createIndexPatternButtonFlyout');
+    }
   }
 
-  async clickCreateNewRollupButton() {
-    await this.testSubjects.click('createRollupIndexPatternButton');
+  async selectRollupIndexPatternType() {
+    await this.testSubjects.click('typeField');
+    await this.testSubjects.click('rollupType');
   }
 
   async getIndexPatternIdFromUrl() {
diff --git a/test/functional/page_objects/visualize_chart_page.ts b/test/functional/page_objects/visualize_chart_page.ts
index 64b8c363fa6c2e..bcee77a21c0b07 100644
--- a/test/functional/page_objects/visualize_chart_page.ts
+++ b/test/functional/page_objects/visualize_chart_page.ts
@@ -115,10 +115,10 @@ export class VisualizeChartPageObject extends FtrService {
       .map((tick) => $(tick).text().trim());
   }
 
-  public async getYAxisLabels() {
+  public async getYAxisLabels(nth = 0) {
     if (await this.isNewLibraryChart(xyChartSelector)) {
-      const [yAxis] = (await this.getEsChartDebugState(xyChartSelector))?.axes?.y ?? [];
-      return yAxis?.labels;
+      const yAxis = (await this.getEsChartDebugState(xyChartSelector))?.axes?.y ?? [];
+      return yAxis[nth]?.labels;
     }
 
     const yAxis = await this.find.byCssSelector('.visAxis__column--y.visAxis__column--left');
@@ -141,14 +141,19 @@ export class VisualizeChartPageObject extends FtrService {
    * Gets the chart data and scales it based on chart height and label.
    * @param dataLabel data-label value
    * @param axis  axis value, 'ValueAxis-1' by default
+   * @param shouldContainXAxisData boolean value for mapping points, false by default
    *
    * Returns an array of height values
    */
-  public async getAreaChartData(dataLabel: string, axis = 'ValueAxis-1') {
+  public async getAreaChartData(
+    dataLabel: string,
+    axis = 'ValueAxis-1',
+    shouldContainXAxisData = false
+  ) {
     if (await this.isNewLibraryChart(xyChartSelector)) {
       const areas = (await this.getEsChartDebugState(xyChartSelector))?.areas ?? [];
       const points = areas.find(({ name }) => name === dataLabel)?.lines.y1.points ?? [];
-      return points.map(({ y }) => y);
+      return shouldContainXAxisData ? points.map(({ x, y }) => [x, y]) : points.map(({ y }) => y);
     }
 
     const yAxisRatio = await this.getChartYAxisRatio(axis);
@@ -556,12 +561,12 @@ export class VisualizeChartPageObject extends FtrService {
     return values.filter((item) => item.length > 0);
   }
 
-  public async getRightValueAxesCount() {
+  public async getAxesCountByPosition(axesPosition: typeof Position[keyof typeof Position]) {
     if (await this.isNewLibraryChart(xyChartSelector)) {
       const yAxes = (await this.getEsChartDebugState(xyChartSelector))?.axes?.y ?? [];
-      return yAxes.filter(({ position }) => position === Position.Right).length;
+      return yAxes.filter(({ position }) => position === axesPosition).length;
     }
-    const axes = await this.find.allByCssSelector('.visAxis__column--right g.axis');
+    const axes = await this.find.allByCssSelector(`.visAxis__column--${axesPosition} g.axis`);
     return axes.length;
   }
 
@@ -576,6 +581,16 @@ export class VisualizeChartPageObject extends FtrService {
     await gauge.clickMouseButton({ xOffset: 0, yOffset });
   }
 
+  public async getAreaSeriesCount() {
+    if (await this.isNewLibraryChart(xyChartSelector)) {
+      const areas = (await this.getEsChartDebugState(xyChartSelector))?.areas ?? [];
+      return areas.filter((area) => area.lines.y1.visible).length;
+    }
+
+    const series = await this.find.allByCssSelector('.points.area');
+    return series.length;
+  }
+
   public async getHistogramSeriesCount() {
     if (await this.isNewLibraryChart(xyChartSelector)) {
       const bars = (await this.getEsChartDebugState(xyChartSelector))?.bars ?? [];
diff --git a/test/functional/page_objects/visualize_editor_page.ts b/test/functional/page_objects/visualize_editor_page.ts
index ab458c2c0fdc12..90fc320da3cda4 100644
--- a/test/functional/page_objects/visualize_editor_page.ts
+++ b/test/functional/page_objects/visualize_editor_page.ts
@@ -532,4 +532,10 @@ export class VisualizeEditorPageObject extends FtrService {
   public async setSeriesType(seriesNth: number, type: string) {
     await this.find.selectValue(`select#seriesType${seriesNth}`, type);
   }
+
+  public async setTimelionInterval(interval: string) {
+    const timelionIntervalComboBoxSelector = 'timelionIntervalComboBox';
+    await this.comboBox.clearInputField(timelionIntervalComboBoxSelector);
+    await this.comboBox.setCustom(timelionIntervalComboBoxSelector, interval);
+  }
 }
diff --git a/test/functional/page_objects/visualize_page.ts b/test/functional/page_objects/visualize_page.ts
index 7e87312a709108..966a9d29b32644 100644
--- a/test/functional/page_objects/visualize_page.ts
+++ b/test/functional/page_objects/visualize_page.ts
@@ -8,7 +8,7 @@
 
 import { FtrService } from '../ftr_provider_context';
 import { VisualizeConstants } from '../../../src/plugins/visualize/public/application/visualize_constants';
-import { UI_SETTINGS } from '../../../src/plugins/data/common';
+import { FORMATS_UI_SETTINGS } from '../../../src/plugins/field_formats/common';
 
 // TODO: Remove & Refactor to use the TTV page objects
 interface VisualizeSaveModalArgs {
@@ -55,7 +55,7 @@ export class VisualizePageObject extends FtrService {
 
     await this.kibanaServer.uiSettings.replace({
       defaultIndex: 'logstash-*',
-      [UI_SETTINGS.FORMAT_BYTES_DEFAULT_PATTERN]: '0,0.[000]b',
+      [FORMATS_UI_SETTINGS.FORMAT_BYTES_DEFAULT_PATTERN]: '0,0.[000]b',
       'visualization:visualize:legacyChartsLibrary': !isNewLibrary,
       'visualization:visualize:legacyPieChartsLibrary': !isNewLibrary,
     });
@@ -197,6 +197,10 @@ export class VisualizePageObject extends FtrService {
     return await this.hasVisType('tile_map');
   }
 
+  public async clickTimelion() {
+    await this.clickVisType('timelion');
+  }
+
   public async clickTagCloud() {
     await this.clickVisType('tagcloud');
   }
diff --git a/test/functional/screenshots/baseline/tsvb_dashboard.png b/test/functional/screenshots/baseline/tsvb_dashboard.png
index 8c922d9d176f77..a36cfffebf080f 100644
Binary files a/test/functional/screenshots/baseline/tsvb_dashboard.png and b/test/functional/screenshots/baseline/tsvb_dashboard.png differ
diff --git a/test/functional/services/monaco_editor.ts b/test/functional/services/monaco_editor.ts
index d2afa1e3b6e92b..90674e101fc4e6 100644
--- a/test/functional/services/monaco_editor.ts
+++ b/test/functional/services/monaco_editor.ts
@@ -27,13 +27,13 @@ export class MonacoEditorService extends FtrService {
     return values[nthIndex] as string;
   }
 
-  public async setCodeEditorValue(nthIndex: number, value: string) {
+  public async setCodeEditorValue(value: string, nthIndex = 0) {
     await this.retry.try(async () => {
       await this.browser.execute(
         (editorIndex, codeEditorValue) => {
           const editor = (window as any).MonacoEnvironment.monaco.editor;
           const instance = editor.getModels()[editorIndex];
-          instance.setValue(JSON.parse(codeEditorValue));
+          instance.setValue(codeEditorValue);
         },
         nthIndex,
         value
diff --git a/test/scripts/jenkins_xpack_package_deb.sh b/test/scripts/jenkins_xpack_package_deb.sh
index 42098a6464f530..626036e8db3f55 100755
--- a/test/scripts/jenkins_xpack_package_deb.sh
+++ b/test/scripts/jenkins_xpack_package_deb.sh
@@ -4,6 +4,7 @@ set -e
 
 source src/dev/ci_setup/setup_env.sh
 
+mkdir -p target
 gsutil -q -m cp "gs://ci-artifacts.kibana.dev/package-testing/$GIT_COMMIT/kibana-*.deb" ./target
 
 export VAGRANT_CWD=test/package
diff --git a/test/scripts/jenkins_xpack_package_docker.sh b/test/scripts/jenkins_xpack_package_docker.sh
index 6cae2258303805..c9f94b2c1eb4f5 100755
--- a/test/scripts/jenkins_xpack_package_docker.sh
+++ b/test/scripts/jenkins_xpack_package_docker.sh
@@ -4,6 +4,7 @@ set -e
 
 source src/dev/ci_setup/setup_env.sh
 
+mkdir -p target
 gsutil -q -m cp "gs://ci-artifacts.kibana.dev/package-testing/$GIT_COMMIT/kibana-[0-9]*-docker-image.tar.gz" ./target
 
 export VAGRANT_CWD=test/package
diff --git a/test/scripts/jenkins_xpack_package_rpm.sh b/test/scripts/jenkins_xpack_package_rpm.sh
index 6aa7754ee4b213..08095ce48c1e5a 100755
--- a/test/scripts/jenkins_xpack_package_rpm.sh
+++ b/test/scripts/jenkins_xpack_package_rpm.sh
@@ -4,6 +4,7 @@ set -e
 
 source src/dev/ci_setup/setup_env.sh
 
+mkdir -p target
 gsutil -q -m cp "gs://ci-artifacts.kibana.dev/package-testing/$GIT_COMMIT/kibana-*.rpm" ./target
 
 export VAGRANT_CWD=test/package
diff --git a/tsconfig.json b/tsconfig.json
index ab5a02702e611e..3d6c29875c9020 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -71,6 +71,7 @@
     { "path": "./src/plugins/visualize/tsconfig.json" },
     { "path": "./src/plugins/index_pattern_management/tsconfig.json" },
     { "path": "./src/plugins/index_pattern_field_editor/tsconfig.json" },
+    { "path": "./src/plugins/index_pattern_editor/tsconfig.json" },
     { "path": "./x-pack/plugins/actions/tsconfig.json" },
     { "path": "./x-pack/plugins/alerting/tsconfig.json" },
     { "path": "./x-pack/plugins/apm/tsconfig.json" },
diff --git a/tsconfig.refs.json b/tsconfig.refs.json
index 1def88087ed86b..1807a7014e3895 100644
--- a/tsconfig.refs.json
+++ b/tsconfig.refs.json
@@ -57,6 +57,7 @@
     { "path": "./src/plugins/visualizations/tsconfig.json" },
     { "path": "./src/plugins/visualize/tsconfig.json" },
     { "path": "./src/plugins/index_pattern_management/tsconfig.json" },
+    { "path": "./src/plugins/index_pattern_editor/tsconfig.json" },
     { "path": "./test/tsconfig.json" },
     { "path": "./x-pack/plugins/actions/tsconfig.json" },
     { "path": "./x-pack/plugins/alerting/tsconfig.json" },
diff --git a/typings/index.d.ts b/typings/index.d.ts
index 2a5c5e3fa430f0..85c001b26031b6 100644
--- a/typings/index.d.ts
+++ b/typings/index.d.ts
@@ -37,3 +37,4 @@ declare module 'react-syntax-highlighter/dist/cjs/prism-light';
 // Monaco languages support
 declare module 'monaco-editor/esm/vs/basic-languages/markdown/markdown';
 declare module 'monaco-editor/esm/vs/basic-languages/css/css';
+declare module 'monaco-editor/esm/vs/basic-languages/yaml/yaml';
diff --git a/x-pack/plugins/apm/common/connections.ts b/x-pack/plugins/apm/common/connections.ts
index aa3863374337c7..1fde50ce5489e3 100644
--- a/x-pack/plugins/apm/common/connections.ts
+++ b/x-pack/plugins/apm/common/connections.ts
@@ -47,6 +47,10 @@ export interface ConnectionStatsItem {
       value: number | null;
       timeseries: Coordinate[];
     };
+    totalTime: {
+      value: number | null;
+      timeseries: Coordinate[];
+    };
   };
 }
 
diff --git a/x-pack/plugins/apm/common/service_map.ts b/x-pack/plugins/apm/common/service_map.ts
index 303f6b02c0ea25..b8e6922414ebf9 100644
--- a/x-pack/plugins/apm/common/service_map.ts
+++ b/x-pack/plugins/apm/common/service_map.ts
@@ -58,9 +58,9 @@ export interface Connection {
   destination: ConnectionNode;
 }
 
-export interface ServiceNodeStats {
-  avgMemoryUsage: number | null;
-  avgCpuUsage: number | null;
+export interface NodeStats {
+  avgMemoryUsage?: number | null;
+  avgCpuUsage?: number | null;
   transactionStats: {
     avgTransactionDuration: number | null;
     avgRequestsPerMinute: number | null;
diff --git a/x-pack/plugins/apm/common/utils/formatters/datetime.ts b/x-pack/plugins/apm/common/utils/formatters/datetime.ts
index 88f70753f47c82..df9cb38b5d0094 100644
--- a/x-pack/plugins/apm/common/utils/formatters/datetime.ts
+++ b/x-pack/plugins/apm/common/utils/formatters/datetime.ts
@@ -108,7 +108,10 @@ function getFormatsAccordingToDateDifference(
 }
 
 export function asAbsoluteDateTime(
-  time: number,
+  /**
+   * timestamp in milliseconds or ISO timestamp
+   */
+  time: number | string,
   timeUnit: TimeUnit = 'milliseconds'
 ) {
   const momentTime = moment(time);
diff --git a/x-pack/plugins/apm/e2e/cypress/integration/apm.feature b/x-pack/plugins/apm/e2e/cypress/integration/apm.feature
deleted file mode 100644
index 0cc8f00d48dfd2..00000000000000
--- a/x-pack/plugins/apm/e2e/cypress/integration/apm.feature
+++ /dev/null
@@ -1,6 +0,0 @@
-Feature: APM
-
-  Scenario: Transaction latency charts
-    Given a user browses the APM UI application
-    When the user inspects the opbeans-node service
-    Then should redirect to correct path
diff --git a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/apm.ts b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/apm.ts
deleted file mode 100644
index d41f4cf5083965..00000000000000
--- a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/apm.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { Given, When, Then } from 'cypress-cucumber-preprocessor/steps';
-import { loginAndWaitForPage } from '../../integration/helpers';
-
-/** The default time in ms to wait for a Cypress command to complete */
-export const DEFAULT_TIMEOUT = 60 * 1000;
-
-Given(`a user browses the APM UI application`, () => {
-  // Open service inventory page
-  loginAndWaitForPage(`/app/apm/services`, {
-    from: '2020-06-01T14:59:32.686Z',
-    to: '2020-06-16T16:59:36.219Z',
-  });
-});
-
-When(`the user inspects the opbeans-node service`, () => {
-  // click opbeans-node service
-  cy.get(':contains(opbeans-node)', { timeout: DEFAULT_TIMEOUT })
-    .last()
-    .click({ force: true });
-});
-
-Then(`should redirect to correct path`, () => {
-  cy.url().should('contain', `/app/apm/services/opbeans-node/overview`);
-});
diff --git a/x-pack/plugins/apm/public/components/app/Settings/agent_configurations/List/index.tsx b/x-pack/plugins/apm/public/components/app/Settings/agent_configurations/List/index.tsx
index 51a025df88d8ed..140584a625b903 100644
--- a/x-pack/plugins/apm/public/components/app/Settings/agent_configurations/List/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/Settings/agent_configurations/List/index.tsx
@@ -127,10 +127,10 @@ export function AgentConfigurationList({
       width: theme.eui.euiSizeXL,
       name: '',
       sortable: true,
-      render: (isApplied: boolean) => (
+      render: (_, { applied_by_agent: appliedByAgent }) => (
         <EuiToolTip
           content={
-            isApplied
+            appliedByAgent
               ? i18n.translate(
                   'xpack.apm.agentConfig.configTable.appliedTooltipMessage',
                   { defaultMessage: 'Applied by at least one agent' }
@@ -142,7 +142,7 @@ export function AgentConfigurationList({
           }
         >
           <EuiHealth
-            color={isApplied ? 'success' : theme.eui.euiColorLightShade}
+            color={appliedByAgent ? 'success' : theme.eui.euiColorLightShade}
           />
         </EuiToolTip>
       ),
@@ -177,7 +177,7 @@ export function AgentConfigurationList({
         { defaultMessage: 'Service environment' }
       ),
       sortable: true,
-      render: (environment: string) => getOptionLabel(environment),
+      render: (_, { service }) => getOptionLabel(service.environment),
     },
     {
       align: 'right',
@@ -187,8 +187,8 @@ export function AgentConfigurationList({
         { defaultMessage: 'Last updated' }
       ),
       sortable: true,
-      render: (value: number) => (
-        <TimestampTooltip time={value} timeUnit="minutes" />
+      render: (_, item) => (
+        <TimestampTooltip time={item['@timestamp']} timeUnit="minutes" />
       ),
     },
     ...(canSave
diff --git a/x-pack/plugins/apm/public/components/app/Settings/anomaly_detection/jobs_list.tsx b/x-pack/plugins/apm/public/components/app/Settings/anomaly_detection/jobs_list.tsx
index d520036d5f387b..81a0da97928300 100644
--- a/x-pack/plugins/apm/public/components/app/Settings/anomaly_detection/jobs_list.tsx
+++ b/x-pack/plugins/apm/public/components/app/Settings/anomaly_detection/jobs_list.tsx
@@ -43,7 +43,7 @@ const columns: Array<ITableColumn<Jobs[0]>> = [
       'xpack.apm.settings.anomalyDetection.jobList.actionColumnLabel',
       { defaultMessage: 'Action' }
     ),
-    render: (jobId: string) => (
+    render: (_, { job_id: jobId }) => (
       <MLExplorerLink jobId={jobId}>
         {i18n.translate(
           'xpack.apm.settings.anomalyDetection.jobList.mlJobLinkText',
diff --git a/x-pack/plugins/apm/public/components/app/Settings/customize_ui/custom_link/custom_link_table.tsx b/x-pack/plugins/apm/public/components/app/Settings/customize_ui/custom_link/custom_link_table.tsx
index f49f27d94a0856..4a242bb661e3a6 100644
--- a/x-pack/plugins/apm/public/components/app/Settings/customize_ui/custom_link/custom_link_table.tsx
+++ b/x-pack/plugins/apm/public/components/app/Settings/customize_ui/custom_link/custom_link_table.tsx
@@ -18,7 +18,7 @@ import React, { useState } from 'react';
 import { CustomLink } from '../../../../../../common/custom_link/custom_link_types';
 import { useApmPluginContext } from '../../../../../context/apm_plugin/use_apm_plugin_context';
 import { LoadingStatePrompt } from '../../../../shared/LoadingStatePrompt';
-import { ManagedTable } from '../../../../shared/managed_table';
+import { ITableColumn, ManagedTable } from '../../../../shared/managed_table';
 import { TimestampTooltip } from '../../../../shared/TimestampTooltip';
 
 interface Props {
@@ -31,7 +31,7 @@ export function CustomLinkTable({ items = [], onCustomLinkSelected }: Props) {
   const { core } = useApmPluginContext();
   const canSave = core.application.capabilities.apm.save;
 
-  const columns = [
+  const columns: Array<ITableColumn<CustomLink>> = [
     {
       field: 'label',
       name: i18n.translate(
diff --git a/x-pack/plugins/apm/public/components/app/backend_inventory/backend_inventory_dependencies_table/index.tsx b/x-pack/plugins/apm/public/components/app/backend_inventory/backend_inventory_dependencies_table/index.tsx
index e4b3d48992efa9..c89526b3320849 100644
--- a/x-pack/plugins/apm/public/components/app/backend_inventory/backend_inventory_dependencies_table/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/backend_inventory/backend_inventory_dependencies_table/index.tsx
@@ -51,11 +51,11 @@ export function BackendInventoryDependenciesTable() {
       return callApmApi({
         endpoint: 'GET /api/apm/backends/top_backends',
         params: {
-          query: { start, end, environment, numBuckets: 20, offset },
+          query: { start, end, environment, numBuckets: 20, offset, kuery },
         },
       });
     },
-    [start, end, environment, offset]
+    [start, end, environment, offset, kuery]
   );
 
   const dependencies =
diff --git a/x-pack/plugins/apm/public/components/app/error_group_overview/List/index.tsx b/x-pack/plugins/apm/public/components/app/error_group_overview/List/index.tsx
index 6e181535cc05c0..0575146a6bf5a8 100644
--- a/x-pack/plugins/apm/public/components/app/error_group_overview/List/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/error_group_overview/List/index.tsx
@@ -17,7 +17,7 @@ import { truncate, unit } from '../../../../utils/style';
 import { ErrorDetailLink } from '../../../shared/Links/apm/ErrorDetailLink';
 import { ErrorOverviewLink } from '../../../shared/Links/apm/ErrorOverviewLink';
 import { APMQueryParams } from '../../../shared/Links/url_helpers';
-import { ManagedTable } from '../../../shared/managed_table';
+import { ITableColumn, ManagedTable } from '../../../shared/managed_table';
 import { TimestampTooltip } from '../../../shared/TimestampTooltip';
 
 const GroupIdLink = euiStyled(ErrorDetailLink)`
@@ -52,8 +52,8 @@ interface Props {
 function ErrorGroupList({ items, serviceName }: Props) {
   const { urlParams } = useUrlParams();
 
-  const columns = useMemo(
-    () => [
+  const columns = useMemo(() => {
+    return [
       {
         name: (
           <>
@@ -80,7 +80,7 @@ function ErrorGroupList({ items, serviceName }: Props) {
         field: 'groupId',
         sortable: false,
         width: `${unit * 6}px`,
-        render: (groupId: string) => {
+        render: (_, { groupId }) => {
           return (
             <GroupIdLink serviceName={serviceName} errorGroupId={groupId}>
               {groupId.slice(0, 5) || NOT_AVAILABLE_LABEL}
@@ -94,7 +94,7 @@ function ErrorGroupList({ items, serviceName }: Props) {
         }),
         field: 'type',
         sortable: false,
-        render: (type: string) => {
+        render: (_, { type }) => {
           return (
             <ErrorLink
               title={type}
@@ -121,18 +121,18 @@ function ErrorGroupList({ items, serviceName }: Props) {
         field: 'message',
         sortable: false,
         width: '50%',
-        render: (message: string, item: ErrorGroupItem) => {
+        render: (_, item: ErrorGroupItem) => {
           return (
             <MessageAndCulpritCell>
               <EuiToolTip
                 id="error-message-tooltip"
-                content={message || NOT_AVAILABLE_LABEL}
+                content={item.message || NOT_AVAILABLE_LABEL}
               >
                 <MessageLink
                   serviceName={serviceName}
                   errorGroupId={item.groupId}
                 >
-                  {message || NOT_AVAILABLE_LABEL}
+                  {item.message || NOT_AVAILABLE_LABEL}
                 </MessageLink>
               </EuiToolTip>
               <br />
@@ -151,8 +151,8 @@ function ErrorGroupList({ items, serviceName }: Props) {
         field: 'handled',
         sortable: false,
         align: 'right',
-        render: (isUnhandled: boolean) =>
-          isUnhandled === false && (
+        render: (_, { handled }) =>
+          handled === false && (
             <EuiBadge color="warning">
               {i18n.translate('xpack.apm.errorsTable.unhandledLabel', {
                 defaultMessage: 'Unhandled',
@@ -167,8 +167,10 @@ function ErrorGroupList({ items, serviceName }: Props) {
         field: 'occurrenceCount',
         sortable: true,
         dataType: 'number',
-        render: (value?: number) =>
-          value ? numeral(value).format('0.[0]a') : NOT_AVAILABLE_LABEL,
+        render: (_, { occurrenceCount }) =>
+          occurrenceCount
+            ? numeral(occurrenceCount).format('0.[0]a')
+            : NOT_AVAILABLE_LABEL,
       },
       {
         field: 'latestOccurrenceAt',
@@ -180,16 +182,15 @@ function ErrorGroupList({ items, serviceName }: Props) {
           }
         ),
         align: 'right',
-        render: (value?: number) =>
-          value ? (
-            <TimestampTooltip time={value} timeUnit="minutes" />
+        render: (_, { latestOccurrenceAt }) =>
+          latestOccurrenceAt ? (
+            <TimestampTooltip time={latestOccurrenceAt} timeUnit="minutes" />
           ) : (
             NOT_AVAILABLE_LABEL
           ),
       },
-    ],
-    [serviceName, urlParams]
-  );
+    ] as Array<ITableColumn<ErrorGroupItem>>;
+  }, [serviceName, urlParams]);
 
   return (
     <ManagedTable
diff --git a/x-pack/plugins/apm/public/components/app/service_dependencies/index.tsx b/x-pack/plugins/apm/public/components/app/service_dependencies/index.tsx
index b89586b42fd6b6..1488c4773359c2 100644
--- a/x-pack/plugins/apm/public/components/app/service_dependencies/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_dependencies/index.tsx
@@ -4,8 +4,35 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import { EuiSpacer } from '@elastic/eui';
+import { EuiTitle } from '@elastic/eui';
+import { EuiPanel } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
 import React from 'react';
+import { ChartPointerEventContextProvider } from '../../../context/chart_pointer_event/chart_pointer_event_context';
+import { ServiceOverviewDependenciesTable } from '../service_overview/service_overview_dependencies_table';
+import { ServiceDependenciesBreakdownChart } from './service_dependencies_breakdown_chart';
 
 export function ServiceDependencies() {
-  return <></>;
+  return (
+    <>
+      <ChartPointerEventContextProvider>
+        <EuiPanel hasBorder={true}>
+          <EuiTitle size="xs">
+            <h2>
+              {i18n.translate(
+                'xpack.apm.serviceDependencies.breakdownChartTitle',
+                {
+                  defaultMessage: 'Time spent by dependency',
+                }
+              )}
+            </h2>
+          </EuiTitle>
+          <ServiceDependenciesBreakdownChart height={200} />
+        </EuiPanel>
+      </ChartPointerEventContextProvider>
+      <EuiSpacer size="m" />
+      <ServiceOverviewDependenciesTable />
+    </>
+  );
 }
diff --git a/x-pack/plugins/apm/public/components/app/service_dependencies/service_dependencies_breakdown_chart.tsx b/x-pack/plugins/apm/public/components/app/service_dependencies/service_dependencies_breakdown_chart.tsx
new file mode 100644
index 00000000000000..a33b0db7c4baf7
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/app/service_dependencies/service_dependencies_breakdown_chart.tsx
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+import { getVizColorForIndex } from '../../../../common/viz_colors';
+import { Coordinate, TimeSeries } from '../../../../typings/timeseries';
+import { useApmServiceContext } from '../../../context/apm_service/use_apm_service_context';
+import { useApmParams } from '../../../hooks/use_apm_params';
+import { useFetcher } from '../../../hooks/use_fetcher';
+import { useTimeRange } from '../../../hooks/use_time_range';
+import { BreakdownChart } from '../../shared/charts/breakdown_chart';
+
+export function ServiceDependenciesBreakdownChart({
+  height,
+}: {
+  height: number;
+}) {
+  const { start, end } = useTimeRange();
+  const { serviceName } = useApmServiceContext();
+
+  const {
+    query: { kuery, environment },
+  } = useApmParams('/services/:serviceName/dependencies');
+
+  const { data, status } = useFetcher(
+    (callApmApi) => {
+      return callApmApi({
+        endpoint: 'GET /api/apm/services/{serviceName}/dependencies/breakdown',
+        params: {
+          path: {
+            serviceName,
+          },
+          query: {
+            start,
+            end,
+            kuery,
+            environment,
+          },
+        },
+      });
+    },
+    [serviceName, start, end, kuery, environment]
+  );
+
+  const timeseries: Array<TimeSeries<Coordinate>> =
+    data?.breakdown.map((item, index) => {
+      return {
+        title: item.title,
+        data: item.data,
+        type: 'area',
+        color: getVizColorForIndex(index),
+      };
+    }) ?? [];
+
+  return (
+    <BreakdownChart
+      fetchStatus={status}
+      height={height}
+      showAnnotations={false}
+      annotations={[]}
+      timeseries={timeseries}
+      yAxisType="duration"
+    />
+  );
+}
diff --git a/x-pack/plugins/apm/public/components/app/service_map/Popover/Buttons.test.tsx b/x-pack/plugins/apm/public/components/app/service_map/Popover/Buttons.test.tsx
deleted file mode 100644
index f6376d201f2e15..00000000000000
--- a/x-pack/plugins/apm/public/components/app/service_map/Popover/Buttons.test.tsx
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { ReactNode } from 'react';
-import { Buttons } from './Buttons';
-import { render } from '@testing-library/react';
-import { MockApmPluginContextWrapper } from '../../../../context/apm_plugin/mock_apm_plugin_context';
-
-function Wrapper({ children }: { children?: ReactNode }) {
-  return <MockApmPluginContextWrapper>{children}</MockApmPluginContextWrapper>;
-}
-
-describe('Popover Buttons', () => {
-  it('renders', () => {
-    expect(() =>
-      render(<Buttons selectedNodeServiceName="test service name" />, {
-        wrapper: Wrapper,
-      })
-    ).not.toThrowError();
-  });
-
-  it('handles focus click', async () => {
-    const onFocusClick = jest.fn();
-    const result = render(
-      <Buttons
-        onFocusClick={onFocusClick}
-        selectedNodeServiceName="test service name"
-      />,
-      { wrapper: Wrapper }
-    );
-    const focusButton = await result.findByText('Focus map');
-
-    focusButton.click();
-
-    expect(onFocusClick).toHaveBeenCalledTimes(1);
-  });
-});
diff --git a/x-pack/plugins/apm/public/components/app/service_map/Popover/Buttons.tsx b/x-pack/plugins/apm/public/components/app/service_map/Popover/Buttons.tsx
deleted file mode 100644
index c4ff430e23fe8f..00000000000000
--- a/x-pack/plugins/apm/public/components/app/service_map/Popover/Buttons.tsx
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-/* eslint-disable @elastic/eui/href-or-on-click */
-
-import { EuiButton, EuiFlexItem } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import React, { MouseEvent } from 'react';
-import { useApmPluginContext } from '../../../../context/apm_plugin/use_apm_plugin_context';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
-import { getAPMHref } from '../../../shared/Links/apm/APMLink';
-import { APMQueryParams } from '../../../shared/Links/url_helpers';
-
-interface ButtonsProps {
-  onFocusClick?: (event: MouseEvent<HTMLAnchorElement>) => void;
-  selectedNodeServiceName: string;
-}
-
-export function Buttons({
-  onFocusClick = () => {},
-  selectedNodeServiceName,
-}: ButtonsProps) {
-  const { core } = useApmPluginContext();
-  const { basePath } = core.http;
-  const urlParams = useUrlParams().urlParams as APMQueryParams;
-
-  const detailsUrl = getAPMHref({
-    basePath,
-    path: `/services/${selectedNodeServiceName}`,
-    query: urlParams,
-  });
-  const focusUrl = getAPMHref({
-    basePath,
-    path: `/services/${selectedNodeServiceName}/service-map`,
-    query: urlParams,
-  });
-
-  return (
-    <>
-      <EuiFlexItem>
-        <EuiButton href={detailsUrl} fill={true}>
-          {i18n.translate('xpack.apm.serviceMap.serviceDetailsButtonText', {
-            defaultMessage: 'Service Details',
-          })}
-        </EuiButton>
-      </EuiFlexItem>
-      <EuiFlexItem>
-        <EuiButton color="secondary" href={focusUrl} onClick={onFocusClick}>
-          {i18n.translate('xpack.apm.serviceMap.focusMapButtonText', {
-            defaultMessage: 'Focus map',
-          })}
-        </EuiButton>
-      </EuiFlexItem>
-    </>
-  );
-}
diff --git a/x-pack/plugins/apm/public/components/app/service_map/Popover/Contents.tsx b/x-pack/plugins/apm/public/components/app/service_map/Popover/Contents.tsx
deleted file mode 100644
index 9030aeed7b13d3..00000000000000
--- a/x-pack/plugins/apm/public/components/app/service_map/Popover/Contents.tsx
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import {
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiHorizontalRule,
-  EuiTitle,
-} from '@elastic/eui';
-import cytoscape from 'cytoscape';
-import React, { MouseEvent } from 'react';
-import { Buttons } from './Buttons';
-import { Info } from './Info';
-import { ServiceStatsFetcher } from './ServiceStatsFetcher';
-import { popoverWidth } from '../cytoscape_options';
-
-interface ContentsProps {
-  isService: boolean;
-  label: string;
-  onFocusClick: (event: MouseEvent<HTMLAnchorElement>) => void;
-  selectedNodeData: cytoscape.NodeDataDefinition;
-  selectedNodeServiceName: string;
-}
-
-// IE 11 does not handle flex properties as expected. With browser detection,
-// we can use regular div elements to render contents that are almost identical.
-//
-// This method of detecting IE is from a Stack Overflow answer:
-// https://stackoverflow.com/a/21825207
-//
-// @ts-expect-error `documentMode` is not recognized as a valid property of `document`.
-const isIE11 = !!window.MSInputMethodContext && !!document.documentMode;
-
-function FlexColumnGroup(props: {
-  children: React.ReactNode;
-  style: React.CSSProperties;
-  direction: 'column';
-  gutterSize: 's';
-}) {
-  if (isIE11) {
-    const { direction, gutterSize, ...rest } = props;
-    return <div {...rest} />;
-  }
-  return <EuiFlexGroup {...props} />;
-}
-function FlexColumnItem(props: { children: React.ReactNode }) {
-  return isIE11 ? <div {...props} /> : <EuiFlexItem {...props} />;
-}
-
-export function Contents({
-  selectedNodeData,
-  isService,
-  label,
-  onFocusClick,
-  selectedNodeServiceName,
-}: ContentsProps) {
-  return (
-    <FlexColumnGroup
-      direction="column"
-      gutterSize="s"
-      style={{ width: popoverWidth }}
-    >
-      <FlexColumnItem>
-        <EuiTitle size="xxs">
-          <h3>{label}</h3>
-        </EuiTitle>
-        <EuiHorizontalRule margin="xs" />
-      </FlexColumnItem>
-      <FlexColumnItem>
-        {isService ? (
-          <ServiceStatsFetcher
-            serviceName={selectedNodeServiceName}
-            serviceAnomalyStats={selectedNodeData.serviceAnomalyStats}
-          />
-        ) : (
-          <Info {...selectedNodeData} />
-        )}
-      </FlexColumnItem>
-      {isService && (
-        <Buttons
-          onFocusClick={onFocusClick}
-          selectedNodeServiceName={selectedNodeServiceName}
-        />
-      )}
-    </FlexColumnGroup>
-  );
-}
diff --git a/x-pack/plugins/apm/public/components/app/service_map/Popover/Info.tsx b/x-pack/plugins/apm/public/components/app/service_map/Popover/Info.tsx
deleted file mode 100644
index 9577a02d68cf2f..00000000000000
--- a/x-pack/plugins/apm/public/components/app/service_map/Popover/Info.tsx
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import {
-  EuiDescriptionList,
-  EuiDescriptionListTitle,
-  EuiDescriptionListDescription,
-} from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import cytoscape from 'cytoscape';
-import React, { Fragment } from 'react';
-import { euiStyled } from '../../../../../../../../src/plugins/kibana_react/common';
-import {
-  SPAN_SUBTYPE,
-  SPAN_TYPE,
-} from '../../../../../common/elasticsearch_fieldnames';
-import { ExternalConnectionNode } from '../../../../../common/service_map';
-
-const ItemRow = euiStyled.div`
-  line-height: 2;
-`;
-
-const SubduedDescriptionListTitle = euiStyled(EuiDescriptionListTitle)`
-  &&& {
-    color: ${({ theme }) => theme.eui.euiTextSubduedColor};
-  }
-`;
-
-const ExternalResourcesList = euiStyled.section`
-  max-height: 360px;
-  overflow: auto;
-`;
-
-interface InfoProps extends cytoscape.NodeDataDefinition {
-  type?: string;
-  subtype?: string;
-  className?: string;
-}
-
-export function Info(data: InfoProps) {
-  // For nodes with span.type "db", convert it to "database".
-  // Otherwise leave it as-is.
-  const type = data[SPAN_TYPE] === 'db' ? 'database' : data[SPAN_TYPE];
-
-  // Externals should not have a subtype so make it undefined if the type is external.
-  const subtype = data[SPAN_TYPE] !== 'external' && data[SPAN_SUBTYPE];
-
-  const listItems = [
-    {
-      title: i18n.translate('xpack.apm.serviceMap.typePopoverStat', {
-        defaultMessage: 'Type',
-      }),
-      description: type,
-    },
-    {
-      title: i18n.translate('xpack.apm.serviceMap.subtypePopoverStat', {
-        defaultMessage: 'Subtype',
-      }),
-      description: subtype,
-    },
-  ];
-
-  if (data.groupedConnections) {
-    return (
-      <ExternalResourcesList>
-        <EuiDescriptionList>
-          {data.groupedConnections.map((resource: ExternalConnectionNode) => {
-            const title =
-              resource.label || resource['span.destination.service.resource'];
-            const desc = `${resource['span.type']} (${resource['span.subtype']})`;
-            return (
-              <Fragment key={resource.id}>
-                <EuiDescriptionListTitle
-                  className="eui-textTruncate"
-                  title={title}
-                >
-                  {title}
-                </EuiDescriptionListTitle>
-                <EuiDescriptionListDescription
-                  className="eui-textTruncate"
-                  title={desc}
-                >
-                  {desc}
-                </EuiDescriptionListDescription>
-              </Fragment>
-            );
-          })}
-        </EuiDescriptionList>
-      </ExternalResourcesList>
-    );
-  }
-
-  return (
-    <>
-      {listItems.map(
-        ({ title, description }) =>
-          description && (
-            <div key={title}>
-              <ItemRow>
-                <SubduedDescriptionListTitle>
-                  {title}
-                </SubduedDescriptionListTitle>
-                <EuiDescriptionListDescription>
-                  {description}
-                </EuiDescriptionListDescription>
-              </ItemRow>
-            </div>
-          )
-      )}
-    </>
-  );
-}
diff --git a/x-pack/plugins/apm/public/components/app/service_map/Popover/Popover.stories.tsx b/x-pack/plugins/apm/public/components/app/service_map/Popover/Popover.stories.tsx
index 324a38ea5db39d..faf807d4d4fc33 100644
--- a/x-pack/plugins/apm/public/components/app/service_map/Popover/Popover.stories.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_map/Popover/Popover.stories.tsx
@@ -5,91 +5,158 @@
  * 2.0.
  */
 
+import { Meta, Story } from '@storybook/react';
 import cytoscape from 'cytoscape';
 import { CoreStart } from 'kibana/public';
-import React, { ComponentType } from 'react';
+import React from 'react';
+import { MemoryRouter } from 'react-router-dom';
+import { Popover } from '.';
+import { createKibanaReactContext } from '../../../../../../../../src/plugins/kibana_react/public';
 import { MockApmPluginContextWrapper } from '../../../../context/apm_plugin/mock_apm_plugin_context';
 import { MockUrlParamsContextProvider } from '../../../../context/url_params_context/mock_url_params_context_provider';
 import { createCallApmApi } from '../../../../services/rest/createCallApmApi';
 import { CytoscapeContext } from '../Cytoscape';
-import { Popover } from '.';
 import exampleGroupedConnectionsData from '../__stories__/example_grouped_connections.json';
 
-export default {
+interface Args {
+  nodeData: cytoscape.NodeDataDefinition;
+}
+
+const stories: Meta<Args> = {
   title: 'app/ServiceMap/Popover',
   component: Popover,
   decorators: [
-    (Story: ComponentType) => {
+    (StoryComponent) => {
       const coreMock = ({
         http: {
-          get: async () => ({
-            avgCpuUsage: 0.32809666568309237,
-            avgErrorRate: 0.556068173242986,
-            avgMemoryUsage: 0.5504868173242986,
-            transactionStats: {
-              avgRequestsPerMinute: 164.47222031860858,
-              avgTransactionDuration: 61634.38905590272,
-            },
-          }),
+          get: () => {
+            return {
+              avgCpuUsage: 0.32809666568309237,
+              avgErrorRate: 0.556068173242986,
+              avgMemoryUsage: 0.5504868173242986,
+              transactionStats: {
+                avgRequestsPerMinute: 164.47222031860858,
+                avgTransactionDuration: 61634.38905590272,
+              },
+            };
+          },
         },
+        notifications: { toasts: { add: () => {} } },
+        uiSettings: { get: () => ({}) },
       } as unknown) as CoreStart;
 
+      const KibanaReactContext = createKibanaReactContext(coreMock);
+
       createCallApmApi(coreMock);
 
       return (
-        <MockUrlParamsContextProvider>
-          <MockApmPluginContextWrapper>
-            <div style={{ height: 325 }}>
-              <Story />
-            </div>
-          </MockApmPluginContextWrapper>
-        </MockUrlParamsContextProvider>
+        <MemoryRouter initialEntries={['/service-map']}>
+          <KibanaReactContext.Provider>
+            <MockUrlParamsContextProvider>
+              <MockApmPluginContextWrapper>
+                <div style={{ height: 325 }}>
+                  <StoryComponent />
+                </div>
+              </MockApmPluginContextWrapper>
+            </MockUrlParamsContextProvider>
+          </KibanaReactContext.Provider>
+        </MemoryRouter>
+      );
+    },
+    (StoryComponent, { args }) => {
+      const node = {
+        data: args?.nodeData!,
+      };
+
+      const cy = cytoscape({
+        elements: [
+          { data: { id: 'upstreamService' } },
+          {
+            data: {
+              id: 'edge',
+              source: 'upstreamService',
+              target: node.data.id,
+            },
+          },
+          node,
+        ],
+      });
+
+      setTimeout(() => {
+        cy.$id(node.data.id!).select();
+      }, 0);
+
+      return (
+        <CytoscapeContext.Provider value={cy}>
+          <StoryComponent />
+        </CytoscapeContext.Provider>
       );
     },
   ],
 };
+export default stories;
 
-export function Example() {
+export const Backend: Story<Args> = () => {
   return <Popover />;
-}
-Example.decorators = [
-  (Story: ComponentType) => {
-    const node = {
-      data: { id: 'example service', 'service.name': 'example service' },
-    };
-
-    const cy = cytoscape({ elements: [node] });
-
-    setTimeout(() => {
-      cy.$id('example service').select();
-    }, 0);
+};
+Backend.args = {
+  nodeData: {
+    'span.subtype': 'postgresql',
+    'span.destination.service.resource': 'postgresql',
+    'span.type': 'db',
+    id: '>postgresql',
+    label: 'postgresql',
+  },
+};
 
-    return (
-      <CytoscapeContext.Provider value={cy}>
-        <Story />
-      </CytoscapeContext.Provider>
-    );
+export const BackendWithLongTitle: Story<Args> = () => {
+  return <Popover />;
+};
+BackendWithLongTitle.args = {
+  nodeData: {
+    'span.subtype': 'http',
+    'span.destination.service.resource':
+      '8b37cb7ca2ae49ada54db165f32d3a19.us-central1.gcp.foundit.no:9243',
+    'span.type': 'external',
+    id: '>8b37cb7ca2ae49ada54db165f32d3a19.us-central1.gcp.foundit.no:9243',
+    label: '8b37cb7ca2ae49ada54db165f32d3a19.us-central1.gcp.foundit.no:9243',
   },
-];
+};
 
-export function Externals() {
+export const ExternalsList: Story<Args> = () => {
   return <Popover />;
-}
-Externals.decorators = [
-  (Story: ComponentType) => {
-    const node = {
-      data: exampleGroupedConnectionsData,
-    };
-    const cy = cytoscape({ elements: [node] });
+};
+ExternalsList.args = {
+  nodeData: exampleGroupedConnectionsData,
+};
 
-    setTimeout(() => {
-      cy.$id(exampleGroupedConnectionsData.id).select();
-    }, 0);
+export const Resource: Story<Args> = () => {
+  return <Popover />;
+};
+Resource.args = {
+  nodeData: {
+    id: '>cdn.loom.com:443',
+    label: 'cdn.loom.com:443',
+    'span.destination.service.resource': 'cdn.loom.com:443',
+    'span.subtype': 'css',
+    'span.type': 'resource',
+  },
+};
 
-    return (
-      <CytoscapeContext.Provider value={cy}>
-        <Story />
-      </CytoscapeContext.Provider>
-    );
+export const Service: Story<Args> = () => {
+  return <Popover />;
+};
+Service.args = {
+  nodeData: {
+    id: 'example service',
+    'service.name': 'example service',
+    serviceAnomalyStats: {
+      serviceName: 'opbeans-java',
+      jobId: 'apm-production-802c-high_mean_transaction_duration',
+      transactionType: 'request',
+      actualValue: 16258.496000000017,
+      anomalyScore: 0,
+      healthStatus: 'healthy',
+    },
   },
-];
+};
diff --git a/x-pack/plugins/apm/public/components/app/service_map/Popover/ServiceStatsFetcher.tsx b/x-pack/plugins/apm/public/components/app/service_map/Popover/ServiceStatsFetcher.tsx
deleted file mode 100644
index 3155a65b06aca9..00000000000000
--- a/x-pack/plugins/apm/public/components/app/service_map/Popover/ServiceStatsFetcher.tsx
+++ /dev/null
@@ -1,115 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import {
-  EuiLoadingSpinner,
-  EuiFlexGroup,
-  EuiHorizontalRule,
-  EuiText,
-} from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import { isNumber } from 'lodash';
-import { ServiceNodeStats } from '../../../../../common/service_map';
-import { ServiceStatsList } from './ServiceStatsList';
-import { useFetcher, FETCH_STATUS } from '../../../../hooks/use_fetcher';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
-import { AnomalyDetection } from './anomaly_detection';
-import { ServiceAnomalyStats } from '../../../../../common/anomaly_detection';
-
-interface ServiceStatsFetcherProps {
-  environment?: string;
-  serviceName: string;
-  serviceAnomalyStats: ServiceAnomalyStats | undefined;
-}
-
-export function ServiceStatsFetcher({
-  serviceName,
-  serviceAnomalyStats,
-}: ServiceStatsFetcherProps) {
-  const {
-    urlParams: { environment, start, end },
-  } = useUrlParams();
-
-  const {
-    data = { transactionStats: {} } as ServiceNodeStats,
-    status,
-  } = useFetcher(
-    (callApmApi) => {
-      if (serviceName && start && end) {
-        return callApmApi({
-          endpoint: 'GET /api/apm/service-map/service/{serviceName}',
-          params: {
-            path: { serviceName },
-            query: { environment, start, end },
-          },
-        });
-      }
-    },
-    [environment, serviceName, start, end],
-    {
-      preservePreviousData: false,
-    }
-  );
-
-  const isLoading = status === FETCH_STATUS.LOADING;
-
-  if (isLoading) {
-    return <LoadingSpinner />;
-  }
-
-  const {
-    avgCpuUsage,
-    avgErrorRate,
-    avgMemoryUsage,
-    transactionStats: { avgRequestsPerMinute, avgTransactionDuration },
-  } = data;
-
-  const hasServiceData = [
-    avgCpuUsage,
-    avgErrorRate,
-    avgMemoryUsage,
-    avgRequestsPerMinute,
-    avgTransactionDuration,
-  ].some((stat) => isNumber(stat));
-
-  if (!hasServiceData) {
-    return (
-      <EuiText color="subdued">
-        {i18n.translate('xpack.apm.serviceMap.popoverMetrics.noDataText', {
-          defaultMessage: `No data for selected environment. Try switching to another environment.`,
-        })}
-      </EuiText>
-    );
-  }
-  return (
-    <>
-      {serviceAnomalyStats && (
-        <>
-          <AnomalyDetection
-            serviceName={serviceName}
-            serviceAnomalyStats={serviceAnomalyStats}
-          />
-          <EuiHorizontalRule margin="xs" />
-        </>
-      )}
-      <ServiceStatsList {...data} />
-    </>
-  );
-}
-
-function LoadingSpinner() {
-  return (
-    <EuiFlexGroup
-      alignItems="center"
-      justifyContent="spaceAround"
-      style={{ height: 170 }}
-    >
-      <EuiLoadingSpinner size="xl" />
-    </EuiFlexGroup>
-  );
-}
diff --git a/x-pack/plugins/apm/public/components/app/service_map/Popover/ServiceStatsList.tsx b/x-pack/plugins/apm/public/components/app/service_map/Popover/ServiceStatsList.tsx
deleted file mode 100644
index 766debc6d55873..00000000000000
--- a/x-pack/plugins/apm/public/components/app/service_map/Popover/ServiceStatsList.tsx
+++ /dev/null
@@ -1,96 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { i18n } from '@kbn/i18n';
-import { isNumber } from 'lodash';
-import React from 'react';
-import { euiStyled } from '../../../../../../../../src/plugins/kibana_react/common';
-import {
-  asDuration,
-  asPercent,
-  asTransactionRate,
-} from '../../../../../common/utils/formatters';
-import { ServiceNodeStats } from '../../../../../common/service_map';
-
-export const ItemRow = euiStyled('tr')`
-  line-height: 2;
-`;
-
-export const ItemTitle = euiStyled('td')`
-  color: ${({ theme }) => theme.eui.euiTextSubduedColor};
-  padding-right: 1rem;
-`;
-
-export const ItemDescription = euiStyled('td')`
-  text-align: right;
-`;
-
-type ServiceStatsListProps = ServiceNodeStats;
-
-export function ServiceStatsList({
-  transactionStats,
-  avgErrorRate,
-  avgCpuUsage,
-  avgMemoryUsage,
-}: ServiceStatsListProps) {
-  const listItems = [
-    {
-      title: i18n.translate(
-        'xpack.apm.serviceMap.avgTransDurationPopoverStat',
-        {
-          defaultMessage: 'Latency (avg.)',
-        }
-      ),
-      description: isNumber(transactionStats.avgTransactionDuration)
-        ? asDuration(transactionStats.avgTransactionDuration)
-        : null,
-    },
-    {
-      title: i18n.translate(
-        'xpack.apm.serviceMap.avgReqPerMinutePopoverMetric',
-        {
-          defaultMessage: 'Throughput (avg.)',
-        }
-      ),
-      description: asTransactionRate(transactionStats.avgRequestsPerMinute),
-    },
-    {
-      title: i18n.translate('xpack.apm.serviceMap.errorRatePopoverStat', {
-        defaultMessage: 'Trans. error rate (avg.)',
-      }),
-      description: asPercent(avgErrorRate, 1, ''),
-    },
-    {
-      title: i18n.translate('xpack.apm.serviceMap.avgCpuUsagePopoverStat', {
-        defaultMessage: 'CPU usage (avg.)',
-      }),
-      description: asPercent(avgCpuUsage, 1, ''),
-    },
-    {
-      title: i18n.translate('xpack.apm.serviceMap.avgMemoryUsagePopoverStat', {
-        defaultMessage: 'Memory usage (avg.)',
-      }),
-      description: asPercent(avgMemoryUsage, 1, ''),
-    },
-  ];
-
-  return (
-    <table>
-      <tbody>
-        {listItems.map(
-          ({ title, description }) =>
-            description && (
-              <ItemRow key={title}>
-                <ItemTitle>{title}</ItemTitle>
-                <ItemDescription>{description}</ItemDescription>
-              </ItemRow>
-            )
-        )}
-      </tbody>
-    </table>
-  );
-}
diff --git a/x-pack/plugins/apm/public/components/app/service_map/Popover/backend_contents.tsx b/x-pack/plugins/apm/public/components/app/service_map/Popover/backend_contents.tsx
new file mode 100644
index 00000000000000..e0fef269f3fafb
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/app/service_map/Popover/backend_contents.tsx
@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiButton, EuiFlexItem } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { TypeOf } from '@kbn/typed-react-router-config';
+import React from 'react';
+import { ContentsProps } from '.';
+import { NodeStats } from '../../../../../common/service_map';
+import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useApmParams } from '../../../../hooks/use_apm_params';
+import { useApmRouter } from '../../../../hooks/use_apm_router';
+import { FETCH_STATUS, useFetcher } from '../../../../hooks/use_fetcher';
+import { ApmRoutes } from '../../../routing/apm_route_config';
+import { StatsList } from './stats_list';
+
+export function BackendContents({ nodeData }: ContentsProps) {
+  const { query } = useApmParams('/*');
+  const apmRouter = useApmRouter();
+  const {
+    urlParams: { environment, start, end },
+  } = useUrlParams();
+
+  const backendName = nodeData.label;
+
+  const { data = { transactionStats: {} } as NodeStats, status } = useFetcher(
+    (callApmApi) => {
+      if (backendName && start && end) {
+        return callApmApi({
+          endpoint: 'GET /api/apm/service-map/backend/{backendName}',
+          params: {
+            path: { backendName },
+            query: {
+              environment,
+              start,
+              end,
+            },
+          },
+        });
+      }
+    },
+    [environment, backendName, start, end],
+    {
+      preservePreviousData: false,
+    }
+  );
+
+  const isLoading = status === FETCH_STATUS.LOADING;
+  const detailsUrl = apmRouter.link('/backends/:backendName/overview', {
+    path: { backendName },
+    query: query as TypeOf<
+      ApmRoutes,
+      '/backends/:backendName/overview'
+    >['query'],
+  });
+
+  return (
+    <>
+      <EuiFlexItem>
+        <StatsList data={data} isLoading={isLoading} />
+      </EuiFlexItem>
+      <EuiFlexItem>
+        <EuiButton href={detailsUrl} fill={true}>
+          {i18n.translate('xpack.apm.serviceMap.backendDetailsButtonText', {
+            defaultMessage: 'Backend Details',
+          })}
+        </EuiButton>
+      </EuiFlexItem>
+    </>
+  );
+}
diff --git a/x-pack/plugins/apm/public/components/app/service_map/Popover/externals_list_contents.tsx b/x-pack/plugins/apm/public/components/app/service_map/Popover/externals_list_contents.tsx
new file mode 100644
index 00000000000000..c8ab7a653b201d
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/app/service_map/Popover/externals_list_contents.tsx
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  EuiDescriptionList,
+  EuiDescriptionListDescription,
+  EuiDescriptionListTitle,
+  EuiFlexItem,
+} from '@elastic/eui';
+import React, { Fragment } from 'react';
+import { ContentsProps } from '.';
+import { euiStyled } from '../../../../../../../../src/plugins/kibana_react/common';
+import {
+  SPAN_DESTINATION_SERVICE_RESOURCE,
+  SPAN_TYPE,
+  SPAN_SUBTYPE,
+} from '../../../../../common/elasticsearch_fieldnames';
+import { ExternalConnectionNode } from '../../../../../common/service_map';
+
+const ExternalResourcesList = euiStyled.section`
+  max-height: 360px;
+  overflow: auto;
+`;
+
+export function ExternalsListContents({ nodeData }: ContentsProps) {
+  return (
+    <EuiFlexItem>
+      <ExternalResourcesList>
+        <EuiDescriptionList>
+          {nodeData.groupedConnections.map(
+            (resource: ExternalConnectionNode) => {
+              const title =
+                resource.label || resource[SPAN_DESTINATION_SERVICE_RESOURCE];
+              const desc = `${resource[SPAN_TYPE]} (${resource[SPAN_SUBTYPE]})`;
+              return (
+                <Fragment key={resource.id}>
+                  <EuiDescriptionListTitle
+                    className="eui-textTruncate"
+                    title={title}
+                  >
+                    {title}
+                  </EuiDescriptionListTitle>
+                  <EuiDescriptionListDescription
+                    className="eui-textTruncate"
+                    title={desc}
+                  >
+                    {desc}
+                  </EuiDescriptionListDescription>
+                </Fragment>
+              );
+            }
+          )}
+        </EuiDescriptionList>
+      </ExternalResourcesList>
+    </EuiFlexItem>
+  );
+}
diff --git a/x-pack/plugins/apm/public/components/app/service_map/Popover/index.tsx b/x-pack/plugins/apm/public/components/app/service_map/Popover/index.tsx
index 4999459b30dcf3..df923730a22274 100644
--- a/x-pack/plugins/apm/public/components/app/service_map/Popover/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_map/Popover/index.tsx
@@ -5,6 +5,14 @@
  * 2.0.
  */
 
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiHorizontalRule,
+  EuiPopover,
+  EuiTitle,
+} from '@elastic/eui';
+import cytoscape from 'cytoscape';
 import React, {
   CSSProperties,
   MouseEvent,
@@ -14,13 +22,39 @@ import React, {
   useRef,
   useState,
 } from 'react';
-import { EuiPopover } from '@elastic/eui';
-import cytoscape from 'cytoscape';
+import {
+  SERVICE_NAME,
+  SPAN_TYPE,
+} from '../../../../../common/elasticsearch_fieldnames';
 import { useTheme } from '../../../../hooks/use_theme';
-import { SERVICE_NAME } from '../../../../../common/elasticsearch_fieldnames';
 import { CytoscapeContext } from '../Cytoscape';
-import { getAnimationOptions } from '../cytoscape_options';
-import { Contents } from './Contents';
+import { getAnimationOptions, popoverWidth } from '../cytoscape_options';
+import { BackendContents } from './backend_contents';
+import { ExternalsListContents } from './externals_list_contents';
+import { ResourceContents } from './resource_contents';
+import { ServiceContents } from './service_contents';
+
+function getContentsComponent(selectedNodeData: cytoscape.NodeDataDefinition) {
+  if (
+    selectedNodeData.groupedConnections &&
+    Array.isArray(selectedNodeData.groupedConnections)
+  ) {
+    return ExternalsListContents;
+  }
+  if (selectedNodeData[SERVICE_NAME]) {
+    return ServiceContents;
+  }
+  if (selectedNodeData[SPAN_TYPE] === 'resource') {
+    return ResourceContents;
+  }
+
+  return BackendContents;
+}
+
+export interface ContentsProps {
+  nodeData: cytoscape.NodeDataDefinition;
+  onFocusClick: (event: MouseEvent<HTMLAnchorElement>) => void;
+}
 
 interface PopoverProps {
   focusedServiceName?: string;
@@ -42,7 +76,6 @@ export function Popover({ focusedServiceName }: PopoverProps) {
   const renderedWidth = selectedNode?.renderedWidth() ?? 0;
   const { x, y } = selectedNode?.renderedPosition() ?? { x: -10000, y: -10000 };
   const isOpen = !!selectedNode;
-  const isService = selectedNode?.data(SERVICE_NAME) !== undefined;
   const triggerStyle: CSSProperties = {
     background: 'transparent',
     height: renderedHeight,
@@ -58,9 +91,8 @@ export function Popover({ focusedServiceName }: PopoverProps) {
     transform: `translate(${x}px, ${translateY}px)`,
   };
   const selectedNodeData = selectedNode?.data() ?? {};
-  const selectedNodeServiceName = selectedNodeData.id;
-  const label = selectedNodeData.label || selectedNodeServiceName;
   const popoverRef = useRef<EuiPopover>(null);
+  const selectedNodeId = selectedNodeData.id;
 
   // Set up Cytoscape event handlers
   useEffect(() => {
@@ -99,19 +131,21 @@ export function Popover({ focusedServiceName }: PopoverProps) {
       if (cy) {
         cy.animate({
           ...getAnimationOptions(theme),
-          center: { eles: cy.getElementById(selectedNodeServiceName) },
+          center: { eles: cy.getElementById(selectedNodeId) },
         });
       }
     },
-    [cy, selectedNodeServiceName, theme]
+    [cy, selectedNodeId, theme]
   );
 
-  const isAlreadyFocused = focusedServiceName === selectedNodeServiceName;
+  const isAlreadyFocused = focusedServiceName === selectedNodeId;
 
   const onFocusClick = isAlreadyFocused
     ? centerSelectedNode
     : (_event: MouseEvent<HTMLAnchorElement>) => deselect();
 
+  const ContentsComponent = getContentsComponent(selectedNodeData);
+
   return (
     <EuiPopover
       anchorPosition={'upCenter'}
@@ -121,13 +155,24 @@ export function Popover({ focusedServiceName }: PopoverProps) {
       ref={popoverRef}
       style={popoverStyle}
     >
-      <Contents
-        isService={isService}
-        label={label}
-        onFocusClick={onFocusClick}
-        selectedNodeData={selectedNodeData}
-        selectedNodeServiceName={selectedNodeServiceName}
-      />
+      <EuiFlexGroup
+        direction="column"
+        gutterSize="s"
+        style={{ width: popoverWidth }}
+      >
+        <EuiFlexItem>
+          <EuiTitle size="xxs">
+            <h3 style={{ wordBreak: 'break-all' }}>
+              {selectedNodeData.label ?? selectedNodeId}
+            </h3>
+          </EuiTitle>
+          <EuiHorizontalRule margin="xs" />
+        </EuiFlexItem>
+        <ContentsComponent
+          onFocusClick={onFocusClick}
+          nodeData={selectedNodeData}
+        />
+      </EuiFlexGroup>
     </EuiPopover>
   );
 }
diff --git a/x-pack/plugins/apm/public/components/app/service_map/Popover/popover.test.tsx b/x-pack/plugins/apm/public/components/app/service_map/Popover/popover.test.tsx
new file mode 100644
index 00000000000000..9678258c4740ce
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/app/service_map/Popover/popover.test.tsx
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { composeStories } from '@storybook/testing-react';
+import { render, screen, waitFor } from '@testing-library/react';
+import React from 'react';
+import * as stories from './Popover.stories';
+
+const { Backend, ExternalsList, Resource, Service } = composeStories(stories);
+
+describe('Popover', () => {
+  describe('with backend data', () => {
+    it('renders a backend link', async () => {
+      render(<Backend />);
+
+      await waitFor(() => {
+        expect(
+          screen.getByRole('link', { name: /backend details/i })
+        ).toBeInTheDocument();
+      });
+    });
+  });
+
+  describe('with externals list data', () => {
+    it('renders an externals list', async () => {
+      render(<ExternalsList />);
+
+      await waitFor(() => {
+        expect(
+          screen.getByText(/813-mam-392.mktoresp.com:443/)
+        ).toBeInTheDocument();
+      });
+    });
+  });
+
+  describe('with resource data', () => {
+    it('renders with no buttons', async () => {
+      render(<Resource />);
+
+      await waitFor(() => {
+        expect(screen.queryByRole('link')).not.toBeInTheDocument();
+      });
+    });
+  });
+
+  describe('with service data', () => {
+    it('renders contents for a service', async () => {
+      render(<Service />);
+
+      await waitFor(() => {
+        expect(
+          screen.getByRole('link', { name: /service details/i })
+        ).toBeInTheDocument();
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/apm/public/components/app/service_map/Popover/resource_contents.tsx b/x-pack/plugins/apm/public/components/app/service_map/Popover/resource_contents.tsx
new file mode 100644
index 00000000000000..e0cfb8f16f61d6
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/app/service_map/Popover/resource_contents.tsx
@@ -0,0 +1,69 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  EuiDescriptionListDescription,
+  EuiDescriptionListTitle,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import React from 'react';
+import type { ContentsProps } from '.';
+import { euiStyled } from '../../../../../../../../src/plugins/kibana_react/common';
+import {
+  SPAN_SUBTYPE,
+  SPAN_TYPE,
+} from '../../../../../common/elasticsearch_fieldnames';
+
+const ItemRow = euiStyled.div`
+  line-height: 2;
+`;
+
+const SubduedDescriptionListTitle = euiStyled(EuiDescriptionListTitle)`
+  &&& {
+    color: ${({ theme }) => theme.eui.euiTextSubduedColor};
+  }
+`;
+
+export function ResourceContents({ nodeData }: ContentsProps) {
+  const subtype = nodeData[SPAN_SUBTYPE];
+  const type = nodeData[SPAN_TYPE];
+
+  const listItems = [
+    {
+      title: i18n.translate('xpack.apm.serviceMap.typePopoverStat', {
+        defaultMessage: 'Type',
+      }),
+      description: type,
+    },
+    {
+      title: i18n.translate('xpack.apm.serviceMap.subtypePopoverStat', {
+        defaultMessage: 'Subtype',
+      }),
+      description: subtype,
+    },
+  ];
+
+  return (
+    <>
+      {listItems.map(
+        ({ title, description }) =>
+          description && (
+            <div key={title}>
+              <ItemRow>
+                <SubduedDescriptionListTitle>
+                  {title}
+                </SubduedDescriptionListTitle>
+                <EuiDescriptionListDescription>
+                  {description}
+                </EuiDescriptionListDescription>
+              </ItemRow>
+            </div>
+          )
+      )}
+    </>
+  );
+}
diff --git a/x-pack/plugins/apm/public/components/app/service_map/Popover/service_contents.tsx b/x-pack/plugins/apm/public/components/app/service_map/Popover/service_contents.tsx
new file mode 100644
index 00000000000000..b486e5e19fb03e
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/app/service_map/Popover/service_contents.tsx
@@ -0,0 +1,90 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/* eslint-disable @elastic/eui/href-or-on-click */
+
+import { EuiButton, EuiFlexItem, EuiHorizontalRule } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import React from 'react';
+import type { ContentsProps } from '.';
+import { NodeStats } from '../../../../../common/service_map';
+import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useApmRouter } from '../../../../hooks/use_apm_router';
+import { FETCH_STATUS, useFetcher } from '../../../../hooks/use_fetcher';
+import { AnomalyDetection } from './anomaly_detection';
+import { StatsList } from './stats_list';
+
+export function ServiceContents({ onFocusClick, nodeData }: ContentsProps) {
+  const apmRouter = useApmRouter();
+
+  const {
+    urlParams: { environment, start, end },
+  } = useUrlParams();
+
+  const serviceName = nodeData.id!;
+
+  const { data = { transactionStats: {} } as NodeStats, status } = useFetcher(
+    (callApmApi) => {
+      if (serviceName && start && end) {
+        return callApmApi({
+          endpoint: 'GET /api/apm/service-map/service/{serviceName}',
+          params: {
+            path: { serviceName },
+            query: { environment, start, end },
+          },
+        });
+      }
+    },
+    [environment, serviceName, start, end],
+    {
+      preservePreviousData: false,
+    }
+  );
+
+  const isLoading = status === FETCH_STATUS.LOADING;
+
+  const detailsUrl = apmRouter.link('/services/:serviceName', {
+    path: { serviceName },
+  });
+
+  const focusUrl = apmRouter.link('/services/:serviceName/service-map', {
+    path: { serviceName },
+  });
+
+  const { serviceAnomalyStats } = nodeData;
+
+  return (
+    <>
+      <EuiFlexItem>
+        {serviceAnomalyStats && (
+          <>
+            <AnomalyDetection
+              serviceName={serviceName}
+              serviceAnomalyStats={serviceAnomalyStats}
+            />
+            <EuiHorizontalRule margin="xs" />
+          </>
+        )}
+        <StatsList data={data} isLoading={isLoading} />
+      </EuiFlexItem>
+      <EuiFlexItem>
+        <EuiButton href={detailsUrl} fill={true}>
+          {i18n.translate('xpack.apm.serviceMap.serviceDetailsButtonText', {
+            defaultMessage: 'Service Details',
+          })}
+        </EuiButton>
+      </EuiFlexItem>
+      <EuiFlexItem>
+        <EuiButton color="secondary" href={focusUrl} onClick={onFocusClick}>
+          {i18n.translate('xpack.apm.serviceMap.focusMapButtonText', {
+            defaultMessage: 'Focus map',
+          })}
+        </EuiButton>
+      </EuiFlexItem>
+    </>
+  );
+}
diff --git a/x-pack/plugins/apm/public/components/app/service_map/Popover/service_stats_list.stories.tsx b/x-pack/plugins/apm/public/components/app/service_map/Popover/service_stats_list.stories.tsx
deleted file mode 100644
index f1a89043f826e1..00000000000000
--- a/x-pack/plugins/apm/public/components/app/service_map/Popover/service_stats_list.stories.tsx
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { ServiceStatsList } from './ServiceStatsList';
-
-export default {
-  title: 'app/ServiceMap/Popover/ServiceStatsList',
-  component: ServiceStatsList,
-};
-
-export function Example() {
-  return (
-    <ServiceStatsList
-      avgCpuUsage={0.32809666568309237}
-      avgMemoryUsage={0.5504868173242986}
-      transactionStats={{
-        avgRequestsPerMinute: 164.47222031860858,
-        avgTransactionDuration: 61634.38905590272,
-      }}
-      avgErrorRate={0.556068173242986}
-    />
-  );
-}
-
-export function SomeNullValues() {
-  return (
-    <ServiceStatsList
-      avgCpuUsage={null}
-      avgErrorRate={0.615972134074397}
-      avgMemoryUsage={null}
-      transactionStats={{
-        avgRequestsPerMinute: 8.439583235652972,
-        avgTransactionDuration: 238792.54809512055,
-      }}
-    />
-  );
-}
-
-export function AllNullValues() {
-  return (
-    <ServiceStatsList
-      avgCpuUsage={null}
-      avgErrorRate={null}
-      avgMemoryUsage={null}
-      transactionStats={{
-        avgRequestsPerMinute: null,
-        avgTransactionDuration: null,
-      }}
-    />
-  );
-}
diff --git a/x-pack/plugins/apm/public/components/app/service_map/Popover/stats_list.tsx b/x-pack/plugins/apm/public/components/app/service_map/Popover/stats_list.tsx
new file mode 100644
index 00000000000000..88915b9bc9f345
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/app/service_map/Popover/stats_list.tsx
@@ -0,0 +1,139 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiFlexGroup, EuiLoadingSpinner, EuiText } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { isNumber } from 'lodash';
+import React from 'react';
+import { euiStyled } from '../../../../../../../../src/plugins/kibana_react/common';
+import { NodeStats } from '../../../../../common/service_map';
+import {
+  asDuration,
+  asPercent,
+  asTransactionRate,
+} from '../../../../../common/utils/formatters';
+
+export const ItemRow = euiStyled.tr`
+  line-height: 2;
+`;
+
+export const ItemTitle = euiStyled.td`
+  color: ${({ theme }) => theme.eui.euiTextSubduedColor};
+  padding-right: 1rem;
+`;
+
+export const ItemDescription = euiStyled.td`
+  text-align: right;
+`;
+
+function LoadingSpinner() {
+  return (
+    <EuiFlexGroup
+      alignItems="center"
+      justifyContent="spaceAround"
+      style={{ height: 170 }}
+    >
+      <EuiLoadingSpinner size="xl" />
+    </EuiFlexGroup>
+  );
+}
+
+function NoDataMessage() {
+  return (
+    <EuiText color="subdued">
+      {i18n.translate('xpack.apm.serviceMap.popover.noDataText', {
+        defaultMessage: `No data for selected environment. Try switching to another environment.`,
+      })}
+    </EuiText>
+  );
+}
+
+interface StatsListProps {
+  isLoading: boolean;
+  data: NodeStats;
+}
+
+export function StatsList({ data, isLoading }: StatsListProps) {
+  const {
+    avgCpuUsage,
+    avgErrorRate,
+    avgMemoryUsage,
+    transactionStats: { avgRequestsPerMinute, avgTransactionDuration },
+  } = data;
+
+  const hasData = [
+    avgCpuUsage,
+    avgErrorRate,
+    avgMemoryUsage,
+    avgRequestsPerMinute,
+    avgTransactionDuration,
+  ].some((stat) => isNumber(stat));
+
+  if (isLoading) {
+    return <LoadingSpinner />;
+  }
+
+  if (!hasData) {
+    return <NoDataMessage />;
+  }
+
+  const items = [
+    {
+      title: i18n.translate(
+        'xpack.apm.serviceMap.avgTransDurationPopoverStat',
+        {
+          defaultMessage: 'Latency (avg.)',
+        }
+      ),
+      description: isNumber(avgTransactionDuration)
+        ? asDuration(avgTransactionDuration)
+        : null,
+    },
+    {
+      title: i18n.translate(
+        'xpack.apm.serviceMap.avgReqPerMinutePopoverMetric',
+        {
+          defaultMessage: 'Throughput (avg.)',
+        }
+      ),
+      description: asTransactionRate(avgRequestsPerMinute),
+    },
+    {
+      title: i18n.translate('xpack.apm.serviceMap.errorRatePopoverStat', {
+        defaultMessage: 'Trans. error rate (avg.)',
+      }),
+      description: asPercent(avgErrorRate, 1, ''),
+    },
+    {
+      title: i18n.translate('xpack.apm.serviceMap.avgCpuUsagePopoverStat', {
+        defaultMessage: 'CPU usage (avg.)',
+      }),
+      description: asPercent(avgCpuUsage, 1, ''),
+    },
+    {
+      title: i18n.translate('xpack.apm.serviceMap.avgMemoryUsagePopoverStat', {
+        defaultMessage: 'Memory usage (avg.)',
+      }),
+      description: asPercent(avgMemoryUsage, 1, ''),
+    },
+  ];
+
+  return (
+    <table>
+      <tbody>
+        {items.map(({ title, description }) => {
+          return description ? (
+            <ItemRow key={title}>
+              <ItemTitle>{title}</ItemTitle>
+              <ItemDescription>{description}</ItemDescription>
+            </ItemRow>
+          ) : null;
+        })}
+      </tbody>
+    </table>
+  );
+}
diff --git a/x-pack/plugins/apm/public/components/app/service_node_overview/index.tsx b/x-pack/plugins/apm/public/components/app/service_node_overview/index.tsx
index 6431a8ad6d01c6..4346b391b36669 100644
--- a/x-pack/plugins/apm/public/components/app/service_node_overview/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_node_overview/index.tsx
@@ -79,7 +79,7 @@ function ServiceNodeOverview() {
       ),
       field: 'name',
       sortable: true,
-      render: (name: string) => {
+      render: (_, { name }) => {
         const { displayedName, tooltip } =
           name === SERVICE_NODE_NAME_MISSING
             ? {
@@ -112,7 +112,7 @@ function ServiceNodeOverview() {
       }),
       field: 'cpu',
       sortable: true,
-      render: (value: number | null) => asPercent(value, 1),
+      render: (_, { cpu }) => asPercent(cpu, 1),
     },
     {
       name: i18n.translate('xpack.apm.jvmsTable.heapMemoryColumnLabel', {
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_dependencies_table/index.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_dependencies_table/index.tsx
index 08d554b9a54e8d..d9df9acf9ff656 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_dependencies_table/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_dependencies_table/index.tsx
@@ -34,7 +34,7 @@ export function ServiceOverviewDependenciesTable() {
   const {
     query,
     query: { kuery, rangeFrom, rangeTo },
-  } = useApmParams('/services/:serviceName/overview');
+  } = useApmParams('/services/:serviceName/*');
 
   const { offset } = getTimeRangeComparison({
     start,
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/get_column.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/get_column.tsx
index b458f6147b3f11..cd2c70b0f10b73 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/get_column.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/get_column.tsx
@@ -51,14 +51,14 @@ export function getColumns({
       },
     },
     {
-      field: 'last_seen',
+      field: 'lastSeen',
       name: i18n.translate(
         'xpack.apm.serviceOverview.errorsTableColumnLastSeen',
         {
           defaultMessage: 'Last seen',
         }
       ),
-      render: (_, { last_seen: lastSeen }) => {
+      render: (_, { lastSeen }) => {
         return <TimestampTooltip time={lastSeen} timeUnit="minutes" />;
       },
       width: `${unit * 9}px`,
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/index.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/index.tsx
index 5c3384df567fed..c8604be50ee15f 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/index.tsx
@@ -32,7 +32,7 @@ type ErrorGroupMainStatistics = APIReturnType<'GET /api/apm/services/{serviceNam
 type ErrorGroupDetailedStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/error_groups/detailed_statistics'>;
 
 type SortDirection = 'asc' | 'desc';
-type SortField = 'name' | 'last_seen' | 'occurrences';
+type SortField = 'name' | 'lastSeen' | 'occurrences';
 
 const PAGE_SIZE = 5;
 const DEFAULT_SORT = {
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_chart_and_table.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_chart_and_table.tsx
index 719409b0f97ffe..a6ef16fe85510a 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_chart_and_table.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_chart_and_table.tsx
@@ -25,14 +25,6 @@ interface ServiceOverviewInstancesChartAndTableProps {
   serviceName: string;
 }
 
-export interface MainStatsServiceInstanceItem {
-  serviceNodeName: string;
-  errorRate: number;
-  throughput: number;
-  latency: number;
-  cpuUsage: number;
-  memoryUsage: number;
-}
 type ApiResponseMainStats = APIReturnType<'GET /api/apm/services/{serviceName}/service_overview_instances/main_statistics'>;
 type ApiResponseDetailedStats = APIReturnType<'GET /api/apm/services/{serviceName}/service_overview_instances/detailed_statistics'>;
 
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/get_columns.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/get_columns.tsx
index d956612a9ac495..1ff896cff57f7d 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/get_columns.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/get_columns.tsx
@@ -31,9 +31,10 @@ import { MetricOverviewLink } from '../../../shared/Links/apm/MetricOverviewLink
 import { ServiceNodeMetricOverviewLink } from '../../../shared/Links/apm/ServiceNodeMetricOverviewLink';
 import { TruncateWithTooltip } from '../../../shared/truncate_with_tooltip';
 import { getLatencyColumnLabel } from '../../../shared/transactions_table/get_latency_column_label';
-import { MainStatsServiceInstanceItem } from '../service_overview_instances_chart_and_table';
 import { InstanceActionsMenu } from './instance_actions_menu';
 
+type ServiceInstanceMainStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/service_overview_instances/main_statistics'>;
+type MainStatsServiceInstanceItem = ServiceInstanceMainStatistics['currentPeriod'][0];
 type ServiceInstanceDetailedStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/service_overview_instances/detailed_statistics'>;
 
 export function getColumns({
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/index.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/index.tsx
index bfd5fea82c6cd7..91955dbea47e52 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/index.tsx
@@ -20,7 +20,6 @@ import { APIReturnType } from '../../../../services/rest/createCallApmApi';
 import { TableFetchWrapper } from '../../../shared/table_fetch_wrapper';
 import {
   PAGE_SIZE,
-  MainStatsServiceInstanceItem,
   SortDirection,
   SortField,
 } from '../service_overview_instances_chart_and_table';
@@ -28,6 +27,8 @@ import { OverviewTableContainer } from '../../../shared/overview_table_container
 import { getColumns } from './get_columns';
 import { InstanceDetails } from './intance_details';
 
+type ServiceInstanceMainStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/service_overview_instances/main_statistics'>;
+type MainStatsServiceInstanceItem = ServiceInstanceMainStatistics['currentPeriod'][0];
 type ServiceInstanceDetailedStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/service_overview_instances/detailed_statistics'>;
 
 export interface TableOptions {
diff --git a/x-pack/plugins/apm/public/components/app/trace_overview/trace_list.tsx b/x-pack/plugins/apm/public/components/app/trace_overview/trace_list.tsx
index f1c8df553abf71..231c49a9a21976 100644
--- a/x-pack/plugins/apm/public/components/app/trace_overview/trace_list.tsx
+++ b/x-pack/plugins/apm/public/components/app/trace_overview/trace_list.tsx
@@ -73,7 +73,8 @@ const traceListColumns: Array<ITableColumn<TraceGroup>> = [
     }),
     sortable: true,
     dataType: 'number',
-    render: (time: number) => asMillisecondDuration(time),
+    render: (_, { averageResponseTime }) =>
+      asMillisecondDuration(averageResponseTime),
   },
   {
     field: 'transactionsPerMinute',
@@ -82,7 +83,8 @@ const traceListColumns: Array<ITableColumn<TraceGroup>> = [
     }),
     sortable: true,
     dataType: 'number',
-    render: (value: number) => asTransactionRate(value),
+    render: (_, { transactionsPerMinute }) =>
+      asTransactionRate(transactionsPerMinute),
   },
   {
     field: 'impact',
@@ -112,7 +114,7 @@ const traceListColumns: Array<ITableColumn<TraceGroup>> = [
     width: '20%',
     align: 'left',
     sortable: true,
-    render: (value: number) => <ImpactBar value={value} />,
+    render: (_, { impact }) => <ImpactBar value={impact} />,
   },
 ];
 
diff --git a/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/Waterfall/span_flyout/index.tsx b/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/Waterfall/span_flyout/index.tsx
index 93acf38a094bc0..50fc56dff7f85a 100644
--- a/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/Waterfall/span_flyout/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/Waterfall/span_flyout/index.tsx
@@ -8,6 +8,7 @@
 import {
   EuiBadge,
   EuiButtonEmpty,
+  EuiCallOut,
   EuiFlexGroup,
   EuiFlexItem,
   EuiFlyoutBody,
@@ -21,6 +22,7 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React, { Fragment } from 'react';
+import { CompositeSpanDurationSummaryItem } from '../../../../../../shared/Summary/CompositeSpanDurationSummaryItem';
 import { euiStyled } from '../../../../../../../../../../../src/plugins/kibana_react/common';
 import { Span } from '../../../../../../../../typings/es_schemas/ui/span';
 import { Transaction } from '../../../../../../../../typings/es_schemas/ui/transaction';
@@ -123,7 +125,6 @@ export function SpanFlyout({
                 </h2>
               </EuiTitle>
             </EuiFlexItem>
-
             <EuiFlexItem grow={false}>
               <DiscoverSpanLink span={span}>
                 <EuiButtonEmpty iconType="discoverApp">
@@ -137,6 +138,21 @@ export function SpanFlyout({
               </DiscoverSpanLink>
             </EuiFlexItem>
           </EuiFlexGroup>
+          {span.span.composite && (
+            <EuiFlexGroup>
+              <EuiFlexItem grow={false}>
+                <EuiCallOut color="warning" iconType="gear" size="s">
+                  {i18n.translate(
+                    'xpack.apm.transactionDetails.spanFlyout.compositeExampleWarning',
+                    {
+                      defaultMessage:
+                        'This is a sample document for a group of consecutive, similar spans',
+                    }
+                  )}
+                </EuiCallOut>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          )}
         </EuiFlyoutHeader>
         <EuiFlyoutBody>
           <StickySpanProperties span={span} transaction={parentTransaction} />
@@ -144,11 +160,19 @@ export function SpanFlyout({
           <Summary
             items={[
               <TimestampTooltip time={span.timestamp.us / 1000} />,
-              <DurationSummaryItem
-                duration={span.span.duration.us}
-                totalDuration={totalDuration}
-                parentType="transaction"
-              />,
+              <>
+                <DurationSummaryItem
+                  duration={span.span.duration.us}
+                  totalDuration={totalDuration}
+                  parentType="transaction"
+                />
+                {span.span.composite && (
+                  <CompositeSpanDurationSummaryItem
+                    count={span.span.composite.count}
+                    durationSum={span.span.composite.sum.us}
+                  />
+                )}
+              </>,
               <>
                 {spanHttpUrl && (
                   <HttpInfoContainer>
diff --git a/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/Waterfall/waterfall_helpers/waterfall_helpers.ts b/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/Waterfall/waterfall_helpers/waterfall_helpers.ts
index 9ace59fae63204..b6e427e8cc0a10 100644
--- a/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/Waterfall/waterfall_helpers/waterfall_helpers.ts
+++ b/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/Waterfall/waterfall_helpers/waterfall_helpers.ts
@@ -7,12 +7,13 @@
 
 import { euiPaletteColorBlind } from '@elastic/eui';
 import { first, flatten, groupBy, isEmpty, sortBy, sum, uniq } from 'lodash';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { TraceAPIResponse } from '../../../../../../../../server/lib/traces/get_trace';
+import { APIReturnType } from '../../../../../../../services/rest/createCallApmApi';
 import { APMError } from '../../../../../../../../typings/es_schemas/ui/apm_error';
 import { Span } from '../../../../../../../../typings/es_schemas/ui/span';
 import { Transaction } from '../../../../../../../../typings/es_schemas/ui/transaction';
 
+type TraceAPIResponse = APIReturnType<'GET /api/apm/traces/{traceId}'>;
+
 interface IWaterfallGroup {
   [key: string]: IWaterfallSpanOrTransaction[];
 }
diff --git a/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/Waterfall/waterfall_item.tsx b/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/Waterfall/waterfall_item.tsx
index a2c2c869a079c2..cd892ae2a16ebe 100644
--- a/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/Waterfall/waterfall_item.tsx
+++ b/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/Waterfall/waterfall_item.tsx
@@ -147,7 +147,15 @@ function HttpStatusCode({ item }: { item: IWaterfallSpanOrTransaction }) {
 function NameLabel({ item }: { item: IWaterfallSpanOrTransaction }) {
   switch (item.docType) {
     case 'span':
-      return <EuiText size="s">{item.doc.span.name}</EuiText>;
+      let name = item.doc.span.name;
+      if (item.doc.span.composite) {
+        const compositePrefix =
+          item.doc.span.composite.compression_strategy === 'exact_match'
+            ? 'x'
+            : '';
+        name = `${item.doc.span.composite.count}${compositePrefix} ${name}`;
+      }
+      return <EuiText size="s">{name}</EuiText>;
     case 'transaction':
       return (
         <EuiTitle size="xxs">
@@ -182,6 +190,9 @@ export function WaterfallItem({
     }
   );
 
+  const isCompositeSpan = item.docType === 'span' && item.doc.span.composite;
+  const itemBarStyle = getItemBarStyle(item, color, width, left);
+
   return (
     <Container
       type={item.docType}
@@ -193,8 +204,8 @@ export function WaterfallItem({
       }}
     >
       <ItemBar // using inline styles instead of props to avoid generating a css class for each item
-        style={{ left: `${left}%`, width: `${width}%` }}
-        color={color}
+        style={itemBarStyle}
+        color={isCompositeSpan ? 'transparent' : color}
         type={item.docType}
       />
       <ItemText // using inline styles instead of props to avoid generating a css class for each item
@@ -227,3 +238,32 @@ export function WaterfallItem({
     </Container>
   );
 }
+
+function getItemBarStyle(
+  item: IWaterfallSpanOrTransaction,
+  color: string,
+  width: number,
+  left: number
+): React.CSSProperties {
+  let itemBarStyle = { left: `${left}%`, width: `${width}%` };
+
+  if (item.docType === 'span' && item.doc.span.composite) {
+    const percNumItems = 100.0 / item.doc.span.composite.count;
+    const spanSumRatio =
+      item.doc.span.composite.sum.us / item.doc.span.duration.us;
+    const percDuration = percNumItems * spanSumRatio;
+
+    itemBarStyle = {
+      ...itemBarStyle,
+      ...{
+        backgroundImage:
+          `repeating-linear-gradient(90deg, ${color},` +
+          ` ${color} max(${percDuration}%,3px),` +
+          ` transparent max(${percDuration}%,3px),` +
+          ` transparent max(${percNumItems}%,max(${percDuration}%,3px) + 3px))`,
+      },
+    };
+  }
+
+  return itemBarStyle;
+}
diff --git a/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/WaterfallContainer.stories.tsx b/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/WaterfallContainer.stories.tsx
index 20ca3194fbfdf2..f8abff2c9609ce 100644
--- a/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/WaterfallContainer.stories.tsx
+++ b/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/WaterfallContainer.stories.tsx
@@ -7,9 +7,8 @@
 
 import React, { ComponentType } from 'react';
 import { MemoryRouter } from 'react-router-dom';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { TraceAPIResponse } from '../../../../../../server/lib/traces/get_trace';
 import { MockApmPluginContextWrapper } from '../../../../../context/apm_plugin/mock_apm_plugin_context';
+import { APIReturnType } from '../../../../../services/rest/createCallApmApi';
 import { WaterfallContainer } from './index';
 import { getWaterfall } from './Waterfall/waterfall_helpers/waterfall_helpers';
 import {
@@ -20,6 +19,8 @@ import {
   urlParams,
 } from './waterfallContainer.stories.data';
 
+type TraceAPIResponse = APIReturnType<'GET /api/apm/traces/{traceId}'>;
+
 export default {
   title: 'app/TransactionDetails/Waterfall',
   component: WaterfallContainer,
diff --git a/x-pack/plugins/apm/public/components/routing/service_detail/redirect_to_default_service_route_view.tsx b/x-pack/plugins/apm/public/components/routing/service_detail/redirect_to_default_service_route_view.tsx
index 37ec76f2b299ea..66595430f618da 100644
--- a/x-pack/plugins/apm/public/components/routing/service_detail/redirect_to_default_service_route_view.tsx
+++ b/x-pack/plugins/apm/public/components/routing/service_detail/redirect_to_default_service_route_view.tsx
@@ -4,17 +4,12 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import qs from 'query-string';
 import React from 'react';
 import { Redirect } from 'react-router-dom';
-import qs from 'query-string';
-import { enableServiceOverview } from '../../../../common/ui_settings_keys';
-import { useApmPluginContext } from '../../../context/apm_plugin/use_apm_plugin_context';
 import { useApmParams } from '../../../hooks/use_apm_params';
 
 export function RedirectToDefaultServiceRouteView() {
-  const {
-    core: { uiSettings },
-  } = useApmPluginContext();
   const {
     path: { serviceName },
     query,
@@ -22,14 +17,7 @@ export function RedirectToDefaultServiceRouteView() {
 
   const search = qs.stringify(query);
 
-  if (uiSettings.get(enableServiceOverview)) {
-    return (
-      <Redirect
-        to={{ pathname: `/services/${serviceName}/overview`, search }}
-      />
-    );
-  }
   return (
-    <Redirect to={{ pathname: `/services/${serviceName}/transactions` }} />
+    <Redirect to={{ pathname: `/services/${serviceName}/overview`, search }} />
   );
 }
diff --git a/x-pack/plugins/apm/public/components/routing/templates/apm_service_template/index.tsx b/x-pack/plugins/apm/public/components/routing/templates/apm_service_template/index.tsx
index c5171a012dc63f..d92d7a8d949229 100644
--- a/x-pack/plugins/apm/public/components/routing/templates/apm_service_template/index.tsx
+++ b/x-pack/plugins/apm/public/components/routing/templates/apm_service_template/index.tsx
@@ -20,7 +20,6 @@ import {
   isJavaAgentName,
   isRumAgentName,
 } from '../../../../../common/agent_name';
-import { enableServiceOverview } from '../../../../../common/ui_settings_keys';
 import { useApmPluginContext } from '../../../../context/apm_plugin/use_apm_plugin_context';
 import { ApmServiceContextProvider } from '../../../../context/apm_service/apm_service_context';
 import { useApmServiceContext } from '../../../../context/apm_service/use_apm_service_context';
@@ -125,7 +124,7 @@ function TemplateWithContext({
 
 function useTabs({ selectedTab }: { selectedTab: Tab['key'] }) {
   const { agentName } = useApmServiceContext();
-  const { core, config } = useApmPluginContext();
+  const { config } = useApmPluginContext();
 
   const router = useApmRouter();
 
@@ -152,7 +151,6 @@ function useTabs({ selectedTab }: { selectedTab: Tab['key'] }) {
       label: i18n.translate('xpack.apm.serviceDetails.overviewTabLabel', {
         defaultMessage: 'Overview',
       }),
-      hidden: !core.uiSettings.get(enableServiceOverview),
     },
     {
       key: 'transactions',
diff --git a/x-pack/plugins/apm/public/components/routing/track_pageview.tsx b/x-pack/plugins/apm/public/components/routing/track_pageview.tsx
index 20e02a505bc436..7f4a03cae90bed 100644
--- a/x-pack/plugins/apm/public/components/routing/track_pageview.tsx
+++ b/x-pack/plugins/apm/public/components/routing/track_pageview.tsx
@@ -11,8 +11,8 @@ import { useTrackPageview } from '../../../../observability/public';
 export function TrackPageview({ children }: { children: React.ReactElement }) {
   const routePath = useRoutePath();
 
-  useTrackPageview({ app: 'apm', path: routePath });
-  useTrackPageview({ app: 'apm', path: routePath, delay: 15000 });
+  useTrackPageview({ app: 'apm', path: routePath }, [routePath]);
+  useTrackPageview({ app: 'apm', path: routePath, delay: 15000 }, [routePath]);
 
   return children;
 }
diff --git a/x-pack/plugins/apm/public/components/shared/Summary/CompositeSpanDurationSummaryItem.tsx b/x-pack/plugins/apm/public/components/shared/Summary/CompositeSpanDurationSummaryItem.tsx
new file mode 100644
index 00000000000000..34f9a631e62aa4
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/shared/Summary/CompositeSpanDurationSummaryItem.tsx
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiToolTip, EuiText } from '@elastic/eui';
+import { asDuration } from '../../../../common/utils/formatters';
+
+interface Props {
+  count: number;
+  durationSum: number;
+}
+
+function CompositeSpanDurationSummaryItem({ count, durationSum }: Props) {
+  const avgDuration = durationSum / count;
+
+  return (
+    <EuiToolTip
+      content={i18n.translate('xpack.apm.compositeSpanDurationLabel', {
+        defaultMessage: 'Average duration',
+      })}
+    >
+      <EuiText>
+        {i18n.translate('xpack.apm.compositeSpanCallsLabel', {
+          defaultMessage: `, {count} calls, on avg. {duration}`,
+          values: {
+            count,
+            duration: asDuration(avgDuration),
+          },
+        })}
+      </EuiText>
+    </EuiToolTip>
+  );
+}
+
+export { CompositeSpanDurationSummaryItem };
diff --git a/x-pack/plugins/apm/public/components/shared/TimestampTooltip/index.tsx b/x-pack/plugins/apm/public/components/shared/TimestampTooltip/index.tsx
index 17c802ab6a3814..c4ba189221c855 100644
--- a/x-pack/plugins/apm/public/components/shared/TimestampTooltip/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/TimestampTooltip/index.tsx
@@ -15,9 +15,9 @@ import {
 
 interface Props {
   /**
-   * timestamp in milliseconds
+   * timestamp in milliseconds or ISO timestamp
    */
-  time: number;
+  time: number | string;
   timeUnit?: TimeUnit;
 }
 
diff --git a/x-pack/plugins/apm/public/components/shared/charts/transaction_breakdown_chart/transaction_breakdown_chart_contents.tsx b/x-pack/plugins/apm/public/components/shared/charts/breakdown_chart/index.tsx
similarity index 88%
rename from x-pack/plugins/apm/public/components/shared/charts/transaction_breakdown_chart/transaction_breakdown_chart_contents.tsx
rename to x-pack/plugins/apm/public/components/shared/charts/breakdown_chart/index.tsx
index 4fdfbff7917d13..f39c39113fedc9 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/transaction_breakdown_chart/transaction_breakdown_chart_contents.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/breakdown_chart/index.tsx
@@ -16,19 +16,21 @@ import {
   Position,
   ScaleType,
   Settings,
+  TickFormatter,
 } from '@elastic/charts';
 import { EuiIcon } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import moment from 'moment';
 import React from 'react';
 import { useHistory } from 'react-router-dom';
+import { Annotation } from '../../../../../common/annotations';
 import { useChartTheme } from '../../../../../../observability/public';
 import {
   asAbsoluteDateTime,
+  asDuration,
   asPercent,
 } from '../../../../../common/utils/formatters';
 import { Coordinate, TimeSeries } from '../../../../../typings/timeseries';
-import { useAnnotationsContext } from '../../../../context/annotations/use_annotations_context';
 import { useChartPointerEventContext } from '../../../../context/chart_pointer_event/use_chart_pointer_event_context';
 import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { FETCH_STATUS } from '../../../../hooks/use_fetcher';
@@ -41,17 +43,23 @@ interface Props {
   fetchStatus: FETCH_STATUS;
   height?: number;
   showAnnotations: boolean;
+  annotations: Annotation[];
   timeseries?: Array<TimeSeries<Coordinate>>;
+  yAxisType: 'duration' | 'percentage';
 }
 
-export function TransactionBreakdownChartContents({
+const asPercentBound = (y: number | null) => asPercent(y, 1);
+const asDurationBound = (y: number | null) => asDuration(y);
+
+export function BreakdownChart({
   fetchStatus,
   height = unit * 16,
   showAnnotations,
+  annotations,
   timeseries,
+  yAxisType,
 }: Props) {
   const history = useHistory();
-  const { annotations } = useAnnotationsContext();
   const chartTheme = useChartTheme();
 
   const { chartRef, setPointerEvent } = useChartPointerEventContext();
@@ -68,6 +76,9 @@ export function TransactionBreakdownChartContents({
 
   const isEmpty = isTimeseriesEmpty(timeseries);
 
+  const yTickFormat: TickFormatter =
+    yAxisType === 'duration' ? asDurationBound : asPercentBound;
+
   return (
     <ChartContainer height={height} hasData={!isEmpty} status={fetchStatus}>
       <Chart ref={chartRef}>
@@ -98,7 +109,7 @@ export function TransactionBreakdownChartContents({
           id="y-axis"
           ticks={3}
           position={Position.Left}
-          tickFormat={(y: number) => asPercent(y ?? 0, 1)}
+          tickFormat={yTickFormat}
         />
 
         {showAnnotations && (
@@ -133,7 +144,9 @@ export function TransactionBreakdownChartContents({
                 yAccessors={['y']}
                 data={serie.data}
                 stackAccessors={['x']}
-                stackMode={'percentage'}
+                stackMode={
+                  yAxisType === 'percentage' ? 'percentage' : undefined
+                }
                 color={serie.areaColor}
                 curve={CurveType.CURVE_MONOTONE_X}
               />
diff --git a/x-pack/plugins/apm/public/components/shared/charts/helper/get_alert_annotations.test.tsx b/x-pack/plugins/apm/public/components/shared/charts/helper/get_alert_annotations.test.tsx
index 01a8293163106e..4f3ac315170208 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/helper/get_alert_annotations.test.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/helper/get_alert_annotations.test.tsx
@@ -11,10 +11,12 @@ import {
   ALERT_EVALUATION_VALUE,
   ALERT_ID,
   ALERT_PRODUCER,
+  ALERT_OWNER,
   ALERT_SEVERITY_LEVEL,
   ALERT_START,
   ALERT_STATUS,
   ALERT_UUID,
+  SPACE_IDS,
 } from '@kbn/rule-data-utils';
 import { ValuesType } from 'utility-types';
 import { EuiTheme } from '../../../../../../../../src/plugins/kibana_react/common';
@@ -32,6 +34,7 @@ const theme = ({
   eui: { euiColorDanger, euiColorWarning },
 } as unknown) as EuiTheme;
 const alert: Alert = {
+  [SPACE_IDS]: ['space-id'],
   'rule.id': ['apm.transaction_duration'],
   [ALERT_EVALUATION_VALUE]: [2057657.39],
   'service.name': ['frontend-rum'],
@@ -42,6 +45,7 @@ const alert: Alert = {
   'transaction.type': ['page-load'],
   [ALERT_PRODUCER]: ['apm'],
   [ALERT_UUID]: ['af2ae371-df79-4fca-b0eb-a2dbd9478180'],
+  [ALERT_OWNER]: ['apm'],
   'rule.uuid': ['82e0ee40-c2f4-11eb-9a42-a9da66a1722f'],
   'event.action': ['active'],
   '@timestamp': ['2021-06-01T16:16:05.183Z'],
diff --git a/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/custom_tooltip.stories.tsx b/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/custom_tooltip.stories.tsx
index 6128526c577e4e..ae3c871e25a1a0 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/custom_tooltip.stories.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/custom_tooltip.stories.tsx
@@ -7,10 +7,13 @@
 
 import { TooltipInfo } from '@elastic/charts';
 import React from 'react';
+import { APIReturnType } from '../../../../services/rest/createCallApmApi';
 import { getDurationFormatter } from '../../../../../common/utils/formatters';
-import { MainStatsServiceInstanceItem } from '../../../app/service_overview/service_overview_instances_chart_and_table';
 import { CustomTooltip } from './custom_tooltip';
 
+type ServiceInstanceMainStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/service_overview_instances/main_statistics'>;
+type MainStatsServiceInstanceItem = ServiceInstanceMainStatistics['currentPeriod'][0];
+
 function getLatencyFormatter(props: TooltipInfo) {
   const maxLatency = Math.max(
     ...props.values.map((value) => {
diff --git a/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/custom_tooltip.tsx b/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/custom_tooltip.tsx
index 027f764317e46f..a0197c2f50c960 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/custom_tooltip.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/instances_latency_distribution_chart/custom_tooltip.tsx
@@ -9,13 +9,16 @@ import { TooltipInfo } from '@elastic/charts';
 import { EuiIcon } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React from 'react';
+import { APIReturnType } from '../../../../services/rest/createCallApmApi';
 import { getServiceNodeName } from '../../../../../common/service_nodes';
 import {
   asTransactionRate,
   TimeFormatter,
 } from '../../../../../common/utils/formatters';
 import { useTheme } from '../../../../hooks/use_theme';
-import { MainStatsServiceInstanceItem } from '../../../app/service_overview/service_overview_instances_chart_and_table';
+
+type ServiceInstanceMainStatistics = APIReturnType<'GET /api/apm/services/{serviceName}/service_overview_instances/main_statistics'>;
+type MainStatsServiceInstanceItem = ServiceInstanceMainStatistics['currentPeriod'][0];
 
 const latencyLabel = i18n.translate(
   'xpack.apm.instancesLatencyDistributionChartTooltipLatencyLabel',
diff --git a/x-pack/plugins/apm/public/components/shared/charts/transaction_breakdown_chart/index.tsx b/x-pack/plugins/apm/public/components/shared/charts/transaction_breakdown_chart/index.tsx
index 40c5e39589fb1f..0e2b1e185f9d93 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/transaction_breakdown_chart/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/transaction_breakdown_chart/index.tsx
@@ -8,8 +8,9 @@
 import { EuiFlexGroup, EuiFlexItem, EuiPanel, EuiTitle } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React from 'react';
+import { useAnnotationsContext } from '../../../../context/annotations/use_annotations_context';
 import { useTransactionBreakdown } from './use_transaction_breakdown';
-import { TransactionBreakdownChartContents } from './transaction_breakdown_chart_contents';
+import { BreakdownChart } from '../breakdown_chart';
 
 export function TransactionBreakdownChart({
   height,
@@ -19,6 +20,7 @@ export function TransactionBreakdownChart({
   showAnnotations?: boolean;
 }) {
   const { data, status } = useTransactionBreakdown();
+  const { annotations } = useAnnotationsContext();
   const { timeseries } = data;
 
   return (
@@ -34,11 +36,13 @@ export function TransactionBreakdownChart({
           </EuiTitle>
         </EuiFlexItem>
         <EuiFlexItem grow={false}>
-          <TransactionBreakdownChartContents
+          <BreakdownChart
             fetchStatus={status}
             height={height}
+            annotations={annotations}
             showAnnotations={showAnnotations}
             timeseries={timeseries}
+            yAxisType="percentage"
           />
         </EuiFlexItem>
       </EuiFlexGroup>
diff --git a/x-pack/plugins/apm/public/components/shared/managed_table/index.tsx b/x-pack/plugins/apm/public/components/shared/managed_table/index.tsx
index 98f8fb41622679..af8b317f5ec33d 100644
--- a/x-pack/plugins/apm/public/components/shared/managed_table/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/managed_table/index.tsx
@@ -21,6 +21,7 @@ export interface ITableColumn<T> {
   align?: string;
   width?: string;
   sortable?: boolean;
+  truncateText?: boolean;
   render?: (value: any, item: T) => unknown;
 }
 
diff --git a/x-pack/plugins/apm/public/components/shared/span_icon/get_span_icon.ts b/x-pack/plugins/apm/public/components/shared/span_icon/get_span_icon.ts
index 93021fe177f6b9..2abb7d03bce80d 100644
--- a/x-pack/plugins/apm/public/components/shared/span_icon/get_span_icon.ts
+++ b/x-pack/plugins/apm/public/components/shared/span_icon/get_span_icon.ts
@@ -40,6 +40,7 @@ export const spanTypeIcons: {
   aws: {
     servicename: awsIcon,
   },
+  cache: { redis: redisIcon },
   db: {
     cassandra: cassandraIcon,
     cosmosdb: azureIcon,
diff --git a/x-pack/plugins/apm/public/services/rest/createCallApmApi.ts b/x-pack/plugins/apm/public/services/rest/createCallApmApi.ts
index 0e82d70faf1e19..217d7e050369d8 100644
--- a/x-pack/plugins/apm/public/services/rest/createCallApmApi.ts
+++ b/x-pack/plugins/apm/public/services/rest/createCallApmApi.ts
@@ -10,12 +10,17 @@ import * as t from 'io-ts';
 import type {
   ClientRequestParamsOf,
   EndpointOf,
+  formatRequest as formatRequestType,
   ReturnOf,
   RouteRepositoryClient,
   ServerRouteRepository,
   ServerRoute,
 } from '@kbn/server-route-repository';
-import { formatRequest } from '@kbn/server-route-repository/target/format_request';
+// @ts-expect-error cannot find module or correspondent type declarations
+// The code and types are at separated folders on @kbn/server-route-repository
+// so in order to do targeted imports they must me imported separately, and
+// an error is expected here
+import { formatRequest } from '@kbn/server-route-repository/target_node/format_request';
 import { FetchOptions } from '../../../common/fetch_options';
 import { callApi } from './callApi';
 import type {
@@ -81,7 +86,10 @@ export function createCallApmApi(core: CoreStart | CoreSetup) {
       params?: Partial<Record<string, any>>;
     };
 
-    const { method, pathname } = formatRequest(endpoint, params?.path);
+    const { method, pathname } = formatRequest(
+      endpoint,
+      params?.path
+    ) as ReturnType<typeof formatRequestType>;
 
     return callApi(core, {
       ...opts,
diff --git a/x-pack/plugins/apm/server/lib/backends/get_throughput_charts_for_backend.ts b/x-pack/plugins/apm/server/lib/backends/get_throughput_charts_for_backend.ts
index 4fbd521ea44433..ae8a6db903d8af 100644
--- a/x-pack/plugins/apm/server/lib/backends/get_throughput_charts_for_backend.ts
+++ b/x-pack/plugins/apm/server/lib/backends/get_throughput_charts_for_backend.ts
@@ -5,7 +5,10 @@
  * 2.0.
  */
 
-import { SPAN_DESTINATION_SERVICE_RESOURCE } from '../../../common/elasticsearch_fieldnames';
+import {
+  SPAN_DESTINATION_SERVICE_RESOURCE,
+  SPAN_DESTINATION_SERVICE_RESPONSE_TIME_COUNT,
+} from '../../../common/elasticsearch_fieldnames';
 import { environmentQuery } from '../../../common/utils/environment_query';
 import { kqlQuery, rangeQuery } from '../../../../observability/server';
 import { ProcessorEvent } from '../../../common/processor_event';
@@ -63,7 +66,10 @@ export async function getThroughputChartsForBackend({
           }),
           aggs: {
             throughput: {
-              rate: {},
+              rate: {
+                field: SPAN_DESTINATION_SERVICE_RESPONSE_TIME_COUNT,
+                unit: 'minute',
+              },
             },
           },
         },
diff --git a/x-pack/plugins/apm/server/lib/backends/get_top_backends.ts b/x-pack/plugins/apm/server/lib/backends/get_top_backends.ts
index 2f9af0bafd37c6..9b361774b8a9f7 100644
--- a/x-pack/plugins/apm/server/lib/backends/get_top_backends.ts
+++ b/x-pack/plugins/apm/server/lib/backends/get_top_backends.ts
@@ -5,10 +5,11 @@
  * 2.0.
  */
 
+import { kqlQuery } from '../../../../observability/server';
+import { NodeType } from '../../../common/connections';
 import { environmentQuery } from '../../../common/utils/environment_query';
 import { getConnectionStats } from '../connections/get_connection_stats';
 import { getConnectionStatsItemsWithRelativeImpact } from '../connections/get_connection_stats/get_connection_stats_items_with_relative_impact';
-import { NodeType } from '../../../common/connections';
 import { Setup } from '../helpers/setup_request';
 
 export async function getTopBackends({
@@ -18,6 +19,7 @@ export async function getTopBackends({
   numBuckets,
   environment,
   offset,
+  kuery,
 }: {
   setup: Setup;
   start: number;
@@ -25,13 +27,14 @@ export async function getTopBackends({
   numBuckets: number;
   environment?: string;
   offset?: string;
+  kuery?: string;
 }) {
   const statsItems = await getConnectionStats({
     setup,
     start,
     end,
     numBuckets,
-    filter: [...environmentQuery(environment)],
+    filter: [...environmentQuery(environment), ...kqlQuery(kuery)],
     offset,
     collapseBy: 'downstream',
   });
diff --git a/x-pack/plugins/apm/server/lib/connections/get_connection_stats/get_stats.ts b/x-pack/plugins/apm/server/lib/connections/get_connection_stats/get_stats.ts
index 94a23f6218e5d4..4f48f3388c0174 100644
--- a/x-pack/plugins/apm/server/lib/connections/get_connection_stats/get_stats.ts
+++ b/x-pack/plugins/apm/server/lib/connections/get_connection_stats/get_stats.ts
@@ -119,6 +119,16 @@ export const getStats = async ({
                 },
               },
             },
+            total_latency_sum: {
+              sum: {
+                field: SPAN_DESTINATION_SERVICE_RESPONSE_TIME_SUM,
+              },
+            },
+            total_latency_count: {
+              sum: {
+                field: SPAN_DESTINATION_SERVICE_RESPONSE_TIME_COUNT,
+              },
+            },
             timeseries: {
               date_histogram: {
                 field: '@timestamp',
@@ -126,6 +136,7 @@ export const getStats = async ({
                   start: startWithOffset,
                   end: endWithOffset,
                   numBuckets,
+                  minBucketSize: 60,
                 }).intervalString,
                 extended_bounds: {
                   min: startWithOffset,
diff --git a/x-pack/plugins/apm/server/lib/connections/get_connection_stats/index.ts b/x-pack/plugins/apm/server/lib/connections/get_connection_stats/index.ts
index 37fcd9877327bf..03b94defda6dd3 100644
--- a/x-pack/plugins/apm/server/lib/connections/get_connection_stats/index.ts
+++ b/x-pack/plugins/apm/server/lib/connections/get_connection_stats/index.ts
@@ -113,6 +113,13 @@ export function getConnectionStats({
             y: point.count > 0 ? point.latency_sum / point.count : null,
           })),
         },
+        totalTime: {
+          value: mergedStats.value.latency_sum,
+          timeseries: mergedStats.timeseries.map((point) => ({
+            x: point.x,
+            y: point.latency_sum,
+          })),
+        },
         throughput: {
           value:
             mergedStats.value.count > 0
diff --git a/x-pack/plugins/apm/server/lib/service_map/get_service_map_backend_node_info.ts b/x-pack/plugins/apm/server/lib/service_map/get_service_map_backend_node_info.ts
new file mode 100644
index 00000000000000..17c3191d80ff41
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/service_map/get_service_map_backend_node_info.ts
@@ -0,0 +1,103 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { rangeQuery } from '../../../../observability/server';
+import {
+  EVENT_OUTCOME,
+  SPAN_DESTINATION_SERVICE_RESOURCE,
+  SPAN_DESTINATION_SERVICE_RESPONSE_TIME_COUNT,
+  SPAN_DESTINATION_SERVICE_RESPONSE_TIME_SUM,
+} from '../../../common/elasticsearch_fieldnames';
+import { EventOutcome } from '../../../common/event_outcome';
+import { ProcessorEvent } from '../../../common/processor_event';
+import { environmentQuery } from '../../../common/utils/environment_query';
+import { withApmSpan } from '../../utils/with_apm_span';
+import { calculateThroughput } from '../helpers/calculate_throughput';
+import { Setup, SetupTimeRange } from '../helpers/setup_request';
+
+interface Options {
+  setup: Setup & SetupTimeRange;
+  environment?: string;
+  backendName: string;
+}
+
+export function getServiceMapBackendNodeInfo({
+  environment,
+  backendName,
+  setup,
+}: Options) {
+  return withApmSpan('get_service_map_backend_node_stats', async () => {
+    const { apmEventClient, start, end } = setup;
+
+    const response = await apmEventClient.search(
+      'get_service_map_backend_node_stats',
+      {
+        apm: {
+          events: [ProcessorEvent.metric],
+        },
+        body: {
+          size: 0,
+          query: {
+            bool: {
+              filter: [
+                { term: { [SPAN_DESTINATION_SERVICE_RESOURCE]: backendName } },
+                ...rangeQuery(start, end),
+                ...environmentQuery(environment),
+              ],
+            },
+          },
+          aggs: {
+            latency_sum: {
+              sum: {
+                field: SPAN_DESTINATION_SERVICE_RESPONSE_TIME_SUM,
+              },
+            },
+            count: {
+              sum: {
+                field: SPAN_DESTINATION_SERVICE_RESPONSE_TIME_COUNT,
+              },
+            },
+            [EVENT_OUTCOME]: {
+              terms: { field: EVENT_OUTCOME, include: [EventOutcome.failure] },
+            },
+          },
+        },
+      }
+    );
+
+    const count = response.aggregations?.count.value ?? 0;
+    const errorCount =
+      response.aggregations?.[EVENT_OUTCOME].buckets[0]?.doc_count ?? 0;
+    const latencySum = response.aggregations?.latency_sum.value ?? 0;
+
+    const avgErrorRate = errorCount / count;
+    const avgTransactionDuration = latencySum / count;
+    const avgRequestsPerMinute = calculateThroughput({
+      start,
+      end,
+      value: count,
+    });
+
+    if (count === 0) {
+      return {
+        avgErrorRate: null,
+        transactionStats: {
+          avgRequestsPerMinute: null,
+          avgTransactionDuration: null,
+        },
+      };
+    }
+
+    return {
+      avgErrorRate,
+      transactionStats: {
+        avgRequestsPerMinute,
+        avgTransactionDuration,
+      },
+    };
+  });
+}
diff --git a/x-pack/plugins/apm/server/lib/services/get_service_dependencies_breakdown.ts b/x-pack/plugins/apm/server/lib/services/get_service_dependencies_breakdown.ts
new file mode 100644
index 00000000000000..8ebf6b7e017d4d
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/services/get_service_dependencies_breakdown.ts
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { sortBy, take } from 'lodash';
+import { getNodeName } from '../../../common/connections';
+import { kqlQuery } from '../../../../observability/server';
+import { SERVICE_NAME } from '../../../common/elasticsearch_fieldnames';
+import { environmentQuery } from '../../../common/utils/environment_query';
+import { Setup } from '../helpers/setup_request';
+import { getConnectionStats } from '../connections/get_connection_stats';
+
+export async function getServiceDependenciesBreakdown({
+  setup,
+  start,
+  end,
+  serviceName,
+  environment,
+  kuery,
+}: {
+  setup: Setup;
+  start: number;
+  end: number;
+  serviceName: string;
+  environment?: string;
+  kuery?: string;
+}) {
+  const items = await getConnectionStats({
+    setup,
+    start,
+    end,
+    numBuckets: 100,
+    collapseBy: 'downstream',
+    filter: [
+      ...environmentQuery(environment),
+      ...kqlQuery(kuery),
+      { term: { [SERVICE_NAME]: serviceName } },
+    ],
+  });
+
+  return take(
+    sortBy(items, (item) => item.stats.totalTime ?? 0).reverse(),
+    20
+  ).map((item) => {
+    const { stats, location } = item;
+
+    return {
+      title: getNodeName(location),
+      data: stats.totalTime.timeseries,
+    };
+  });
+}
diff --git a/x-pack/plugins/apm/server/lib/services/get_service_error_groups/get_service_error_group_main_statistics.ts b/x-pack/plugins/apm/server/lib/services/get_service_error_groups/get_service_error_group_main_statistics.ts
index 0e4ed72814cbbf..0d50e14fc89b02 100644
--- a/x-pack/plugins/apm/server/lib/services/get_service_error_groups/get_service_error_group_main_statistics.ts
+++ b/x-pack/plugins/apm/server/lib/services/get_service_error_groups/get_service_error_group_main_statistics.ts
@@ -82,7 +82,7 @@ export async function getServiceErrorGroupMainStatistics({
     response.aggregations?.error_groups.buckets.map((bucket) => ({
       group_id: bucket.key as string,
       name: getErrorName(bucket.sample.hits.hits[0]._source),
-      last_seen: new Date(
+      lastSeen: new Date(
         bucket.sample.hits.hits[0]?._source['@timestamp']
       ).getTime(),
       occurrences: bucket.doc_count,
diff --git a/x-pack/plugins/apm/server/lib/services/get_service_error_groups/index.ts b/x-pack/plugins/apm/server/lib/services/get_service_error_groups/index.ts
index b89bc86e29172d..a58539da722c3e 100644
--- a/x-pack/plugins/apm/server/lib/services/get_service_error_groups/index.ts
+++ b/x-pack/plugins/apm/server/lib/services/get_service_error_groups/index.ts
@@ -47,7 +47,7 @@ export async function getServiceErrorGroups({
   pageIndex: number;
   numBuckets: number;
   sortDirection: 'asc' | 'desc';
-  sortField: 'name' | 'last_seen' | 'occurrences';
+  sortField: 'name' | 'lastSeen' | 'occurrences';
   transactionType: string;
 }) {
   return withApmSpan('get_service_error_groups', async () => {
@@ -108,7 +108,7 @@ export async function getServiceErrorGroups({
       response.aggregations?.error_groups.buckets.map((bucket) => ({
         group_id: bucket.key as string,
         name: getErrorName(bucket.sample.hits.hits[0]._source),
-        last_seen: new Date(
+        lastSeen: new Date(
           bucket.sample.hits.hits[0]?._source['@timestamp']
         ).getTime(),
         occurrences: {
diff --git a/x-pack/plugins/apm/server/lib/services/get_service_instance_metadata_details.ts b/x-pack/plugins/apm/server/lib/services/get_service_instance_metadata_details.ts
index 1479b0fdbb73c0..4d67a0a2b43adb 100644
--- a/x-pack/plugins/apm/server/lib/services/get_service_instance_metadata_details.ts
+++ b/x-pack/plugins/apm/server/lib/services/get_service_instance_metadata_details.ts
@@ -19,11 +19,6 @@ import {
   getProcessorEventForAggregatedTransactions,
 } from '../helpers/aggregated_transactions';
 
-export interface KeyValue {
-  key: string;
-  value: any | undefined;
-}
-
 export async function getServiceInstanceMetadataDetails({
   serviceName,
   serviceNodeName,
diff --git a/x-pack/plugins/apm/server/lib/traces/get_trace.ts b/x-pack/plugins/apm/server/lib/traces/get_trace.ts
index 3c60cd84fca397..a0cc6b7241d4e5 100644
--- a/x-pack/plugins/apm/server/lib/traces/get_trace.ts
+++ b/x-pack/plugins/apm/server/lib/traces/get_trace.ts
@@ -5,11 +5,9 @@
  * 2.0.
  */
 
-import { PromiseReturnType } from '../../../../observability/typings/common';
 import { Setup, SetupTimeRange } from '../helpers/setup_request';
 import { getTraceItems } from './get_trace_items';
 
-export type TraceAPIResponse = PromiseReturnType<typeof getTrace>;
 export async function getTrace(traceId: string, setup: Setup & SetupTimeRange) {
   const { errorsPerTransaction, ...trace } = await getTraceItems(
     traceId,
diff --git a/x-pack/plugins/apm/server/lib/traces/get_trace_items.ts b/x-pack/plugins/apm/server/lib/traces/get_trace_items.ts
index 026cf9dcceb791..6c957df3138667 100644
--- a/x-pack/plugins/apm/server/lib/traces/get_trace_items.ts
+++ b/x-pack/plugins/apm/server/lib/traces/get_trace_items.ts
@@ -15,15 +15,10 @@ import {
   TRANSACTION_ID,
   ERROR_LOG_LEVEL,
 } from '../../../common/elasticsearch_fieldnames';
-import { APMError } from '../../../typings/es_schemas/ui/apm_error';
 import { rangeQuery } from '../../../../observability/server';
 import { Setup, SetupTimeRange } from '../helpers/setup_request';
 import { PromiseValueType } from '../../../typings/common';
 
-export interface ErrorsPerTransaction {
-  [transactionId: string]: number;
-}
-
 export async function getTraceItems(
   traceId: string,
   setup: Setup & SetupTimeRange
@@ -96,10 +91,7 @@ export async function getTraceItems(
 
   const items = traceResponse.hits.hits.map((hit) => hit._source);
 
-  const errorFrequencies: {
-    errorsPerTransaction: ErrorsPerTransaction;
-    errorDocs: APMError[];
-  } = {
+  const errorFrequencies = {
     errorDocs: errorResponse.hits.hits.map(({ _source }) => _source),
     errorsPerTransaction:
       errorResponse.aggregations?.by_transaction_id.buckets.reduce(
@@ -109,7 +101,7 @@ export async function getTraceItems(
             [current.key]: current.doc_count,
           };
         },
-        {} as ErrorsPerTransaction
+        {} as Record<string, number>
       ) ?? {},
   };
 
diff --git a/x-pack/plugins/apm/server/plugin.ts b/x-pack/plugins/apm/server/plugin.ts
index 50dd09a6366e86..24d41e2574bbed 100644
--- a/x-pack/plugins/apm/server/plugin.ts
+++ b/x-pack/plugins/apm/server/plugin.ts
@@ -33,7 +33,6 @@ import { createApmAgentConfigurationIndex } from './lib/settings/agent_configura
 import { getApmIndices } from './lib/settings/apm_indices/get_apm_indices';
 import { createApmCustomLinkIndex } from './lib/settings/custom_link/create_custom_link_index';
 import { apmIndices, apmTelemetry, apmServerSettings } from './saved_objects';
-import { uiSettings } from './ui_settings';
 import type {
   ApmPluginRequestHandlerContext,
   APMRouteHandlerResources,
@@ -81,8 +80,6 @@ export class APMPlugin
     core.savedObjects.registerType(apmTelemetry);
     core.savedObjects.registerType(apmServerSettings);
 
-    core.uiSettings.register(uiSettings);
-
     const currentConfig = mergeConfigs(
       plugins.apmOss.config,
       this.initContext.config.get<APMXPackConfig>()
diff --git a/x-pack/plugins/apm/server/routes/backends.ts b/x-pack/plugins/apm/server/routes/backends.ts
index c738e9aa64007c..e673770dbbc1a2 100644
--- a/x-pack/plugins/apm/server/routes/backends.ts
+++ b/x-pack/plugins/apm/server/routes/backends.ts
@@ -25,7 +25,7 @@ const topBackendsRoute = createApmServerRoute({
       query: t.intersection([rangeRt, t.type({ numBuckets: toNumberRt })]),
     }),
     t.partial({
-      query: t.intersection([environmentRt, offsetRt]),
+      query: t.intersection([environmentRt, offsetRt, kueryRt]),
     }),
   ]),
   options: {
@@ -35,9 +35,9 @@ const topBackendsRoute = createApmServerRoute({
     const setup = await setupRequest(resources);
 
     const { start, end } = setup;
-    const { environment, offset, numBuckets } = resources.params.query;
+    const { environment, offset, numBuckets, kuery } = resources.params.query;
 
-    const opts = { setup, start, end, numBuckets, environment };
+    const opts = { setup, start, end, numBuckets, environment, kuery };
 
     const [currentBackends, previousBackends] = await Promise.all([
       getTopBackends(opts),
diff --git a/x-pack/plugins/apm/server/routes/register_routes/index.test.ts b/x-pack/plugins/apm/server/routes/register_routes/index.test.ts
index b9dece866fae55..b748d187c5e478 100644
--- a/x-pack/plugins/apm/server/routes/register_routes/index.test.ts
+++ b/x-pack/plugins/apm/server/routes/register_routes/index.test.ts
@@ -7,7 +7,7 @@
 
 import { jsonRt } from '@kbn/io-ts-utils';
 import { createServerRouteRepository } from '@kbn/server-route-repository';
-import { ServerRoute } from '@kbn/server-route-repository/target/typings';
+import { ServerRoute } from '@kbn/server-route-repository';
 import * as t from 'io-ts';
 import { CoreSetup, Logger } from 'src/core/server';
 import { APMConfig } from '../..';
diff --git a/x-pack/plugins/apm/server/routes/service_map.ts b/x-pack/plugins/apm/server/routes/service_map.ts
index 267479de4c102b..023753932d21ff 100644
--- a/x-pack/plugins/apm/server/routes/service_map.ts
+++ b/x-pack/plugins/apm/server/routes/service_map.ts
@@ -7,16 +7,17 @@
 
 import Boom from '@hapi/boom';
 import * as t from 'io-ts';
+import { isActivePlatinumLicense } from '../../common/license_check';
 import { invalidLicenseMessage } from '../../common/service_map';
+import { notifyFeatureUsage } from '../feature';
+import { getSearchAggregatedTransactions } from '../lib/helpers/aggregated_transactions';
 import { setupRequest } from '../lib/helpers/setup_request';
 import { getServiceMap } from '../lib/service_map/get_service_map';
+import { getServiceMapBackendNodeInfo } from '../lib/service_map/get_service_map_backend_node_info';
 import { getServiceMapServiceNodeInfo } from '../lib/service_map/get_service_map_service_node_info';
 import { createApmServerRoute } from './create_apm_server_route';
-import { environmentRt, rangeRt } from './default_api_types';
-import { notifyFeatureUsage } from '../feature';
-import { getSearchAggregatedTransactions } from '../lib/helpers/aggregated_transactions';
-import { isActivePlatinumLicense } from '../../common/license_check';
 import { createApmServerRouteRepository } from './create_apm_server_route_repository';
+import { environmentRt, rangeRt } from './default_api_types';
 
 const serviceMapRoute = createApmServerRoute({
   endpoint: 'GET /api/apm/service-map',
@@ -100,6 +101,40 @@ const serviceMapServiceNodeRoute = createApmServerRoute({
   },
 });
 
+const serviceMapBackendNodeRoute = createApmServerRoute({
+  endpoint: 'GET /api/apm/service-map/backend/{backendName}',
+  params: t.type({
+    path: t.type({
+      backendName: t.string,
+    }),
+    query: t.intersection([environmentRt, rangeRt]),
+  }),
+  options: { tags: ['access:apm'] },
+  handler: async (resources) => {
+    const { config, context, params } = resources;
+
+    if (!config['xpack.apm.serviceMapEnabled']) {
+      throw Boom.notFound();
+    }
+    if (!isActivePlatinumLicense(context.licensing.license)) {
+      throw Boom.forbidden(invalidLicenseMessage);
+    }
+    const setup = await setupRequest(resources);
+
+    const {
+      path: { backendName },
+      query: { environment },
+    } = params;
+
+    return getServiceMapBackendNodeInfo({
+      environment,
+      setup,
+      backendName,
+    });
+  },
+});
+
 export const serviceMapRouteRepository = createApmServerRouteRepository()
   .add(serviceMapRoute)
-  .add(serviceMapServiceNodeRoute);
+  .add(serviceMapServiceNodeRoute)
+  .add(serviceMapBackendNodeRoute);
diff --git a/x-pack/plugins/apm/server/routes/services.ts b/x-pack/plugins/apm/server/routes/services.ts
index 87eac9374fd020..f5156fe85fbf57 100644
--- a/x-pack/plugins/apm/server/routes/services.ts
+++ b/x-pack/plugins/apm/server/routes/services.ts
@@ -42,6 +42,7 @@ import {
 } from './default_api_types';
 import { offsetPreviousPeriodCoordinates } from '../../common/utils/offset_previous_period_coordinate';
 import { getServicesDetailedStatistics } from '../lib/services/get_services_detailed_statistics';
+import { getServiceDependenciesBreakdown } from '../lib/services/get_service_dependencies_breakdown';
 
 const servicesRoute = createApmServerRoute({
   endpoint: 'GET /api/apm/services',
@@ -692,6 +693,38 @@ export const serviceDependenciesRoute = createApmServerRoute({
   },
 });
 
+export const serviceDependenciesBreakdownRoute = createApmServerRoute({
+  endpoint: 'GET /api/apm/services/{serviceName}/dependencies/breakdown',
+  params: t.type({
+    path: t.type({
+      serviceName: t.string,
+    }),
+    query: t.intersection([environmentRt, rangeRt, kueryRt]),
+  }),
+  options: {
+    tags: ['access:apm'],
+  },
+  handler: async (resources) => {
+    const setup = await setupRequest(resources);
+    const { params } = resources;
+    const { serviceName } = params.path;
+    const { environment, start, end, kuery } = params.query;
+
+    const breakdown = await getServiceDependenciesBreakdown({
+      setup,
+      start,
+      end,
+      serviceName,
+      environment,
+      kuery,
+    });
+
+    return {
+      breakdown,
+    };
+  },
+});
+
 const serviceProfilingTimelineRoute = createApmServerRoute({
   endpoint: 'GET /api/apm/services/{serviceName}/profiling/timeline',
   params: t.type({
@@ -822,6 +855,7 @@ export const serviceRouteRepository = createApmServerRouteRepository()
   .add(serviceInstancesMainStatisticsRoute)
   .add(serviceInstancesDetailedStatisticsRoute)
   .add(serviceDependenciesRoute)
+  .add(serviceDependenciesBreakdownRoute)
   .add(serviceProfilingTimelineRoute)
   .add(serviceProfilingStatisticsRoute)
   .add(serviceAlertsRoute);
diff --git a/x-pack/plugins/apm/server/ui_settings.ts b/x-pack/plugins/apm/server/ui_settings.ts
deleted file mode 100644
index 0161b11cf07844..00000000000000
--- a/x-pack/plugins/apm/server/ui_settings.ts
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { schema } from '@kbn/config-schema';
-import { i18n } from '@kbn/i18n';
-import { UiSettingsParams } from '../../../../src/core/types';
-import { observabilityFeatureId } from '../../observability/common';
-import { enableServiceOverview } from '../common/ui_settings_keys';
-
-/**
- * uiSettings definitions for APM.
- */
-export const uiSettings: Record<string, UiSettingsParams<boolean>> = {
-  [enableServiceOverview]: {
-    category: [observabilityFeatureId],
-    name: i18n.translate('xpack.apm.enableServiceOverviewExperimentName', {
-      defaultMessage: 'APM Service overview',
-    }),
-    value: true,
-    description: i18n.translate(
-      'xpack.apm.enableServiceOverviewExperimentDescription',
-      {
-        defaultMessage: 'Enable the Overview tab for services in APM.',
-      }
-    ),
-    schema: schema.boolean(),
-  },
-};
diff --git a/x-pack/plugins/apm/typings/es_schemas/raw/span_raw.ts b/x-pack/plugins/apm/typings/es_schemas/raw/span_raw.ts
index 6b6f94779a9afe..4865396cae7b24 100644
--- a/x-pack/plugins/apm/typings/es_schemas/raw/span_raw.ts
+++ b/x-pack/plugins/apm/typings/es_schemas/raw/span_raw.ts
@@ -54,6 +54,11 @@ export interface SpanRaw extends APMBaseDoc {
       body?: string;
       headers?: Record<string, unknown>;
     };
+    composite?: {
+      count: number;
+      sum: { us: number };
+      compression_strategy: string;
+    };
   };
   timestamp: TimestampUs;
   transaction?: {
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/elements/metric/index.ts b/x-pack/plugins/canvas/canvas_plugin_src/elements/metric/index.ts
index 06376bf1d750b9..76176f6ba21330 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/elements/metric/index.ts
+++ b/x-pack/plugins/canvas/canvas_plugin_src/elements/metric/index.ts
@@ -8,7 +8,7 @@
 import { openSans } from '../../../common/lib/fonts';
 import { ElementFactory } from '../../../types';
 import { SetupInitializer } from '../../plugin';
-import { UI_SETTINGS } from '../../../../../../src/plugins/data/public';
+import { FORMATS_UI_SETTINGS } from '../../../../../../src/plugins/field_formats/common';
 
 export const metricElementInitializer: SetupInitializer<ElementFactory> = (core, setup) => {
   return () => ({
@@ -22,10 +22,10 @@ export const metricElementInitializer: SetupInitializer<ElementFactory> = (core,
     expression: `filters
   | demodata
   | math "unique(country)"
-  | metric "Countries" 
-    metricFont={font size=48 family="${openSans.value}" color="#000000" align="center" lHeight=48} 
+  | metric "Countries"
+    metricFont={font size=48 family="${openSans.value}" color="#000000" align="center" lHeight=48}
     labelFont={font size=14 family="${openSans.value}" color="#000000" align="center"}
-    metricFormat="${core.uiSettings.get(UI_SETTINGS.FORMAT_NUMBER_DEFAULT_PATTERN)}"
+    metricFormat="${core.uiSettings.get(FORMATS_UI_SETTINGS.FORMAT_NUMBER_DEFAULT_PATTERN)}"
   | render`,
   });
 };
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/time_filter/components/__stories__/__snapshots__/time_filter.stories.storyshot b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/time_filter/components/__stories__/__snapshots__/time_filter.stories.storyshot
index 422a61d4ef03e7..a712563966e0bd 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/time_filter/components/__stories__/__snapshots__/time_filter.stories.storyshot
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/time_filter/components/__stories__/__snapshots__/time_filter.stories.storyshot
@@ -164,6 +164,7 @@ exports[`Storyshots renderers/TimeFilter with absolute time bounds 1`] = `
               >
                 <div
                   className="euiTextColor euiTextColor--subdued"
+                  style={Object {}}
                 >
                   →
                 </div>
@@ -440,6 +441,7 @@ exports[`Storyshots renderers/TimeFilter with relative time bounds 1`] = `
               >
                 <div
                   className="euiTextColor euiTextColor--subdued"
+                  style={Object {}}
                 >
                   →
                 </div>
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/uis/arguments/axis_config/__stories__/__snapshots__/extended_template.stories.storyshot b/x-pack/plugins/canvas/canvas_plugin_src/uis/arguments/axis_config/__stories__/__snapshots__/extended_template.stories.storyshot
index c2f9d887246097..f7c50907424fd5 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/uis/arguments/axis_config/__stories__/__snapshots__/extended_template.stories.storyshot
+++ b/x-pack/plugins/canvas/canvas_plugin_src/uis/arguments/axis_config/__stories__/__snapshots__/extended_template.stories.storyshot
@@ -169,6 +169,7 @@ exports[`Storyshots arguments/AxisConfig/components extended disabled 1`] = `
   >
     <div
       className="euiTextColor euiTextColor--subdued"
+      style={Object {}}
     >
       <p>
         Switch on to view axis settings
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/uis/arguments/number_format/index.ts b/x-pack/plugins/canvas/canvas_plugin_src/uis/arguments/number_format/index.ts
index 90f5da78f79b2c..7c7d573bcd76c6 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/uis/arguments/number_format/index.ts
+++ b/x-pack/plugins/canvas/canvas_plugin_src/uis/arguments/number_format/index.ts
@@ -11,7 +11,7 @@ import { templateFromReactComponent } from '../../../../public/lib/template_from
 import { ArgumentFactory } from '../../../../types/arguments';
 import { ArgumentStrings } from '../../../../i18n';
 import { SetupInitializer } from '../../../plugin';
-import { UI_SETTINGS } from '../../../../../../../src/plugins/data/public';
+import { FORMATS_UI_SETTINGS } from '../../../../../../../src/plugins/field_formats/common';
 
 const { NumberFormat: strings } = ArgumentStrings;
 
@@ -20,11 +20,11 @@ export const numberFormatInitializer: SetupInitializer<ArgumentFactory<Component
   plugins
 ) => {
   const formatMap = {
-    NUMBER: core.uiSettings.get(UI_SETTINGS.FORMAT_NUMBER_DEFAULT_PATTERN),
-    PERCENT: core.uiSettings.get(UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN),
-    CURRENCY: core.uiSettings.get(UI_SETTINGS.FORMAT_CURRENCY_DEFAULT_PATTERN),
+    NUMBER: core.uiSettings.get(FORMATS_UI_SETTINGS.FORMAT_NUMBER_DEFAULT_PATTERN),
+    PERCENT: core.uiSettings.get(FORMATS_UI_SETTINGS.FORMAT_PERCENT_DEFAULT_PATTERN),
+    CURRENCY: core.uiSettings.get(FORMATS_UI_SETTINGS.FORMAT_CURRENCY_DEFAULT_PATTERN),
     DURATION: '00:00:00',
-    BYTES: core.uiSettings.get(UI_SETTINGS.FORMAT_BYTES_DEFAULT_PATTERN),
+    BYTES: core.uiSettings.get(FORMATS_UI_SETTINGS.FORMAT_BYTES_DEFAULT_PATTERN),
   };
 
   const numberFormats = [
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/uis/views/metric.ts b/x-pack/plugins/canvas/canvas_plugin_src/uis/views/metric.ts
index 501c3fb464c905..775588226aa807 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/uis/views/metric.ts
+++ b/x-pack/plugins/canvas/canvas_plugin_src/uis/views/metric.ts
@@ -8,7 +8,7 @@
 import { openSans } from '../../../common/lib/fonts';
 import { ViewStrings } from '../../../i18n';
 import { SetupInitializer } from '../../plugin';
-import { UI_SETTINGS } from '../../../../../../src/plugins/data/public';
+import { FORMATS_UI_SETTINGS } from '../../../../../../src/plugins/field_formats/common';
 
 const { Metric: strings } = ViewStrings;
 
@@ -24,7 +24,7 @@ export const metricInitializer: SetupInitializer<unknown> = (core, plugin) => {
         displayName: strings.getMetricFormatDisplayName(),
         help: strings.getMetricFormatHelp(),
         argType: 'numberFormat',
-        default: `"${core.uiSettings.get(UI_SETTINGS.FORMAT_NUMBER_DEFAULT_PATTERN)}"`,
+        default: `"${core.uiSettings.get(FORMATS_UI_SETTINGS.FORMAT_NUMBER_DEFAULT_PATTERN)}"`,
       },
       {
         name: '_',
diff --git a/x-pack/plugins/canvas/kibana.json b/x-pack/plugins/canvas/kibana.json
index 263284564de806..c465176e7ed015 100644
--- a/x-pack/plugins/canvas/kibana.json
+++ b/x-pack/plugins/canvas/kibana.json
@@ -36,6 +36,7 @@
       "lens",
       "maps",
       "savedObjects",
-      "visualizations"
+      "visualizations",
+      "fieldFormats"
     ]
   }
diff --git a/x-pack/plugins/canvas/public/components/asset_manager/__stories__/__snapshots__/asset.stories.storyshot b/x-pack/plugins/canvas/public/components/asset_manager/__stories__/__snapshots__/asset.stories.storyshot
index 138f8a2af68f09..19b44540943b34 100644
--- a/x-pack/plugins/canvas/public/components/asset_manager/__stories__/__snapshots__/asset.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/asset_manager/__stories__/__snapshots__/asset.stories.storyshot
@@ -43,6 +43,7 @@ exports[`Storyshots components/Assets/Asset airplane 1`] = `
           <br />
           <span
             className="euiTextColor euiTextColor--subdued"
+            style={Object {}}
           >
             <small>
               (
@@ -229,6 +230,7 @@ exports[`Storyshots components/Assets/Asset marker 1`] = `
           <br />
           <span
             className="euiTextColor euiTextColor--subdued"
+            style={Object {}}
           >
             <small>
               (
diff --git a/x-pack/plugins/canvas/public/components/asset_manager/__stories__/__snapshots__/asset_manager.stories.storyshot b/x-pack/plugins/canvas/public/components/asset_manager/__stories__/__snapshots__/asset_manager.stories.storyshot
index d567d3cf85f13b..05ef9df1c86016 100644
--- a/x-pack/plugins/canvas/public/components/asset_manager/__stories__/__snapshots__/asset_manager.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/asset_manager/__stories__/__snapshots__/asset_manager.stories.storyshot
@@ -95,6 +95,7 @@ exports[`Storyshots components/Assets/AssetManager no assets 1`] = `
           >
             <div
               className="euiTextColor euiTextColor--subdued"
+              style={Object {}}
             >
               <p>
                 Below are the image assets in this workpad. Any assets that are currently in use cannot be determined at this time. To reclaim space, delete assets.
@@ -278,6 +279,7 @@ exports[`Storyshots components/Assets/AssetManager two assets 1`] = `
           >
             <div
               className="euiTextColor euiTextColor--subdued"
+              style={Object {}}
             >
               <p>
                 Below are the image assets in this workpad. Any assets that are currently in use cannot be determined at this time. To reclaim space, delete assets.
@@ -325,6 +327,7 @@ exports[`Storyshots components/Assets/AssetManager two assets 1`] = `
                     <br />
                     <span
                       className="euiTextColor euiTextColor--subdued"
+                      style={Object {}}
                     >
                       <small>
                         (
@@ -500,6 +503,7 @@ exports[`Storyshots components/Assets/AssetManager two assets 1`] = `
                     <br />
                     <span
                       className="euiTextColor euiTextColor--subdued"
+                      style={Object {}}
                     >
                       <small>
                         (
diff --git a/x-pack/plugins/canvas/public/components/datasource/__stories__/__snapshots__/datasource_component.stories.storyshot b/x-pack/plugins/canvas/public/components/datasource/__stories__/__snapshots__/datasource_component.stories.storyshot
index 836047959caeec..6e665f48b3e9a0 100644
--- a/x-pack/plugins/canvas/public/components/datasource/__stories__/__snapshots__/datasource_component.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/datasource/__stories__/__snapshots__/datasource_component.stories.storyshot
@@ -41,6 +41,7 @@ exports[`Storyshots components/datasource/DatasourceComponent datasource with ex
     >
       <div
         className="euiTextColor euiTextColor--default"
+        style={Object {}}
       >
         <p>
           The datasource has an argument controlled by an expression. Use the expression editor to modify the datasource.
diff --git a/x-pack/plugins/canvas/public/components/home/my_workpads/__snapshots__/empty_prompt.stories.storyshot b/x-pack/plugins/canvas/public/components/home/my_workpads/__snapshots__/empty_prompt.stories.storyshot
index c6468cf5a6f0ac..6d782713d8fc17 100644
--- a/x-pack/plugins/canvas/public/components/home/my_workpads/__snapshots__/empty_prompt.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/home/my_workpads/__snapshots__/empty_prompt.stories.storyshot
@@ -34,6 +34,7 @@ exports[`Storyshots Home/Components/Empty Prompt Empty Prompt 1`] = `
         </h2>
         <span
           className="euiTextColor euiTextColor--subdued"
+          style={Object {}}
         >
           <div
             className="euiSpacer euiSpacer--m"
diff --git a/x-pack/plugins/canvas/public/components/saved_elements_modal/__stories__/__snapshots__/saved_elements_modal.stories.storyshot b/x-pack/plugins/canvas/public/components/saved_elements_modal/__stories__/__snapshots__/saved_elements_modal.stories.storyshot
index 6cd18b83c33517..372cd12db1b993 100644
--- a/x-pack/plugins/canvas/public/components/saved_elements_modal/__stories__/__snapshots__/saved_elements_modal.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/saved_elements_modal/__stories__/__snapshots__/saved_elements_modal.stories.storyshot
@@ -103,6 +103,7 @@ exports[`Storyshots components/SavedElementsModal no custom elements 1`] = `
             </h2>
             <span
               className="euiTextColor euiTextColor--subdued"
+              style={Object {}}
             >
               <div
                 className="euiSpacer euiSpacer--m"
diff --git a/x-pack/plugins/canvas/public/components/tool_tip_shortcut/__stories__/__snapshots__/tool_tip_shortcut.stories.storyshot b/x-pack/plugins/canvas/public/components/tool_tip_shortcut/__stories__/__snapshots__/tool_tip_shortcut.stories.storyshot
index aee1e2148e8c48..ca958a1042b460 100644
--- a/x-pack/plugins/canvas/public/components/tool_tip_shortcut/__stories__/__snapshots__/tool_tip_shortcut.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/tool_tip_shortcut/__stories__/__snapshots__/tool_tip_shortcut.stories.storyshot
@@ -18,6 +18,7 @@ exports[`Storyshots components/ToolTipShortcut with alt 1`] = `
     >
       <div
         className="euiTextColor euiTextColor--ghost"
+        style={Object {}}
       >
         ⌥  +  P
       </div>
@@ -44,6 +45,7 @@ exports[`Storyshots components/ToolTipShortcut with cmd 1`] = `
     >
       <div
         className="euiTextColor euiTextColor--ghost"
+        style={Object {}}
       >
         ⌘  +  D
       </div>
@@ -70,6 +72,7 @@ exports[`Storyshots components/ToolTipShortcut with down arrow 1`] = `
     >
       <div
         className="euiTextColor euiTextColor--ghost"
+        style={Object {}}
       >
         ⌘  +  SHIFT  +  ↓
       </div>
@@ -96,6 +99,7 @@ exports[`Storyshots components/ToolTipShortcut with left arrow 1`] = `
     >
       <div
         className="euiTextColor euiTextColor--ghost"
+        style={Object {}}
       >
         ←
       </div>
@@ -122,6 +126,7 @@ exports[`Storyshots components/ToolTipShortcut with right arrow 1`] = `
     >
       <div
         className="euiTextColor euiTextColor--ghost"
+        style={Object {}}
       >
         →
       </div>
@@ -148,6 +153,7 @@ exports[`Storyshots components/ToolTipShortcut with shortcut 1`] = `
     >
       <div
         className="euiTextColor euiTextColor--ghost"
+        style={Object {}}
       >
         G
       </div>
@@ -174,6 +180,7 @@ exports[`Storyshots components/ToolTipShortcut with up arrow 1`] = `
     >
       <div
         className="euiTextColor euiTextColor--ghost"
+        style={Object {}}
       >
         ⌘  +  SHIFT  +  ↑
       </div>
diff --git a/x-pack/plugins/canvas/public/components/var_config/__stories__/__snapshots__/delete_var.stories.storyshot b/x-pack/plugins/canvas/public/components/var_config/__stories__/__snapshots__/delete_var.stories.storyshot
index a83682140693dd..f5351b0d8ea5f8 100644
--- a/x-pack/plugins/canvas/public/components/var_config/__stories__/__snapshots__/delete_var.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/var_config/__stories__/__snapshots__/delete_var.stories.storyshot
@@ -46,6 +46,7 @@ Array [
           >
             <div
               className="euiTextColor euiTextColor--subdued"
+              style={Object {}}
             >
               Deleting this variable may adversely affect the workpad. Are you sure you wish to continue?
             </div>
diff --git a/x-pack/plugins/canvas/shareable_runtime/components/__stories__/__snapshots__/canvas.stories.storyshot b/x-pack/plugins/canvas/shareable_runtime/components/__stories__/__snapshots__/canvas.stories.storyshot
index d23371d0c34991..c5b6d768c89d8d 100644
--- a/x-pack/plugins/canvas/shareable_runtime/components/__stories__/__snapshots__/canvas.stories.storyshot
+++ b/x-pack/plugins/canvas/shareable_runtime/components/__stories__/__snapshots__/canvas.stories.storyshot
@@ -1344,6 +1344,7 @@ exports[`Storyshots shareables/Canvas component 1`] = `
                 >
                   <div
                     className="euiTextColor euiTextColor--ghost"
+                    style={Object {}}
                   >
                     <div
                       className="eui-textTruncate"
@@ -1410,6 +1411,7 @@ exports[`Storyshots shareables/Canvas component 1`] = `
                         >
                           <div
                             className="euiTextColor euiTextColor--ghost"
+                            style={Object {}}
                           >
                             Page 
                             1
@@ -2826,6 +2828,7 @@ exports[`Storyshots shareables/Canvas contextual: austin 1`] = `
                 >
                   <div
                     className="euiTextColor euiTextColor--ghost"
+                    style={Object {}}
                   >
                     <div
                       className="eui-textTruncate"
@@ -2892,6 +2895,7 @@ exports[`Storyshots shareables/Canvas contextual: austin 1`] = `
                         >
                           <div
                             className="euiTextColor euiTextColor--ghost"
+                            style={Object {}}
                           >
                             Page 
                             1
@@ -3124,6 +3128,7 @@ exports[`Storyshots shareables/Canvas contextual: hello 1`] = `
                 >
                   <div
                     className="euiTextColor euiTextColor--ghost"
+                    style={Object {}}
                   >
                     <div
                       className="eui-textTruncate"
@@ -3190,6 +3195,7 @@ exports[`Storyshots shareables/Canvas contextual: hello 1`] = `
                         >
                           <div
                             className="euiTextColor euiTextColor--ghost"
+                            style={Object {}}
                           >
                             Page 
                             1
diff --git a/x-pack/plugins/canvas/shareable_runtime/components/footer/__stories__/__snapshots__/footer.stories.storyshot b/x-pack/plugins/canvas/shareable_runtime/components/footer/__stories__/__snapshots__/footer.stories.storyshot
index 57af8bcb4fecf2..3f89e485e1ba04 100644
--- a/x-pack/plugins/canvas/shareable_runtime/components/footer/__stories__/__snapshots__/footer.stories.storyshot
+++ b/x-pack/plugins/canvas/shareable_runtime/components/footer/__stories__/__snapshots__/footer.stories.storyshot
@@ -1297,6 +1297,7 @@ exports[`Storyshots shareables/Footer contextual: austin 1`] = `
               >
                 <div
                   className="euiTextColor euiTextColor--ghost"
+                  style={Object {}}
                 >
                   <div
                     className="eui-textTruncate"
@@ -1363,6 +1364,7 @@ exports[`Storyshots shareables/Footer contextual: austin 1`] = `
                       >
                         <div
                           className="euiTextColor euiTextColor--ghost"
+                          style={Object {}}
                         >
                           Page 
                           1
@@ -1549,6 +1551,7 @@ exports[`Storyshots shareables/Footer contextual: hello 1`] = `
               >
                 <div
                   className="euiTextColor euiTextColor--ghost"
+                  style={Object {}}
                 >
                   <div
                     className="eui-textTruncate"
@@ -1615,6 +1618,7 @@ exports[`Storyshots shareables/Footer contextual: hello 1`] = `
                       >
                         <div
                           className="euiTextColor euiTextColor--ghost"
+                          style={Object {}}
                         >
                           Page 
                           1
diff --git a/x-pack/plugins/canvas/shareable_runtime/components/footer/__stories__/__snapshots__/page_controls.stories.storyshot b/x-pack/plugins/canvas/shareable_runtime/components/footer/__stories__/__snapshots__/page_controls.stories.storyshot
index 81b0ee9cca8323..791e1bd9081af3 100644
--- a/x-pack/plugins/canvas/shareable_runtime/components/footer/__stories__/__snapshots__/page_controls.stories.storyshot
+++ b/x-pack/plugins/canvas/shareable_runtime/components/footer/__stories__/__snapshots__/page_controls.stories.storyshot
@@ -58,6 +58,7 @@ exports[`Storyshots shareables/Footer/PageControls component 1`] = `
             >
               <div
                 className="euiTextColor euiTextColor--ghost"
+                style={Object {}}
               >
                 Page 
                 1
@@ -155,6 +156,7 @@ exports[`Storyshots shareables/Footer/PageControls contextual: austin 1`] = `
             >
               <div
                 className="euiTextColor euiTextColor--ghost"
+                style={Object {}}
               >
                 Page 
                 1
@@ -252,6 +254,7 @@ exports[`Storyshots shareables/Footer/PageControls contextual: hello 1`] = `
             >
               <div
                 className="euiTextColor euiTextColor--ghost"
+                style={Object {}}
               >
                 Page 
                 1
diff --git a/x-pack/plugins/canvas/shareable_runtime/components/footer/__stories__/__snapshots__/title.stories.storyshot b/x-pack/plugins/canvas/shareable_runtime/components/footer/__stories__/__snapshots__/title.stories.storyshot
index 7d27ac836e1307..2b326fd0ec51aa 100644
--- a/x-pack/plugins/canvas/shareable_runtime/components/footer/__stories__/__snapshots__/title.stories.storyshot
+++ b/x-pack/plugins/canvas/shareable_runtime/components/footer/__stories__/__snapshots__/title.stories.storyshot
@@ -51,6 +51,7 @@ exports[`Storyshots shareables/Footer/Title component 1`] = `
       >
         <div
           className="euiTextColor euiTextColor--ghost"
+          style={Object {}}
         >
           <div
             className="eui-textTruncate"
@@ -115,6 +116,7 @@ exports[`Storyshots shareables/Footer/Title contextual: austin 1`] = `
       >
         <div
           className="euiTextColor euiTextColor--ghost"
+          style={Object {}}
         >
           <div
             className="eui-textTruncate"
@@ -179,6 +181,7 @@ exports[`Storyshots shareables/Footer/Title contextual: hello 1`] = `
       >
         <div
           className="euiTextColor euiTextColor--ghost"
+          style={Object {}}
         >
           <div
             className="eui-textTruncate"
diff --git a/x-pack/plugins/cases/public/components/all_cases/all_cases_generic.test.tsx b/x-pack/plugins/cases/public/components/all_cases/all_cases_generic.test.tsx
index 47c683becb244a..0e548fd53c89d6 100644
--- a/x-pack/plugins/cases/public/components/all_cases/all_cases_generic.test.tsx
+++ b/x-pack/plugins/cases/public/components/all_cases/all_cases_generic.test.tsx
@@ -7,20 +7,27 @@
 
 import React from 'react';
 import { mount } from 'enzyme';
-import { AllCasesGeneric } from './all_cases_generic';
+import { act } from 'react-dom/test-utils';
 
+import { AllCasesGeneric } from './all_cases_generic';
 import { TestProviders } from '../../common/mock';
 import { useGetTags } from '../../containers/use_get_tags';
 import { useGetReporters } from '../../containers/use_get_reporters';
 import { useGetActionLicense } from '../../containers/use_get_action_license';
+import { useConnectors } from '../../containers/configure/use_connectors';
+import { useKibana } from '../../common/lib/kibana';
 import { StatusAll } from '../../containers/types';
 import { CaseStatuses, SECURITY_SOLUTION_OWNER } from '../../../common';
-import { act } from 'react-dom/test-utils';
+import { connectorsMock } from '../../containers/mock';
+import { actionTypeRegistryMock } from '../../../../triggers_actions_ui/public/application/action_type_registry.mock';
+import { triggersActionsUiMock } from '../../../../triggers_actions_ui/public/mocks';
 
 jest.mock('../../containers/use_get_reporters');
 jest.mock('../../containers/use_get_tags');
 jest.mock('../../containers/use_get_action_license');
+jest.mock('../../containers/configure/use_connectors');
 jest.mock('../../containers/api');
+jest.mock('../../common/lib/kibana');
 
 const createCaseNavigation = { href: '', onClick: jest.fn() };
 
@@ -34,26 +41,34 @@ const alertDataMock = {
   alertId: 'alert-id',
   owner: SECURITY_SOLUTION_OWNER,
 };
+
+const useKibanaMock = useKibana as jest.Mocked<typeof useKibana>;
+const useConnectorsMock = useConnectors as jest.Mock;
+const mockTriggersActionsUiService = triggersActionsUiMock.createStart();
+
 jest.mock('../../common/lib/kibana', () => {
   const originalModule = jest.requireActual('../../common/lib/kibana');
   return {
     ...originalModule,
     useKibana: () => ({
       services: {
-        triggersActionsUi: {
-          actionTypeRegistry: {
-            get: jest.fn().mockReturnValue({
-              actionTypeTitle: '.jira',
-              iconClass: 'logoSecurity',
-            }),
-          },
-        },
+        triggersActionsUi: mockTriggersActionsUiService,
       },
     }),
   };
 });
 
 describe('AllCasesGeneric ', () => {
+  const { createMockActionTypeModel } = actionTypeRegistryMock;
+
+  beforeAll(() => {
+    connectorsMock.forEach((connector) =>
+      useKibanaMock().services.triggersActionsUi.actionTypeRegistry.register(
+        createMockActionTypeModel({ id: connector.actionTypeId, iconClass: 'logoSecurity' })
+      )
+    );
+  });
+
   beforeEach(() => {
     jest.resetAllMocks();
     (useGetTags as jest.Mock).mockReturnValue({ tags: ['coke', 'pepsi'], fetchTags: jest.fn() });
@@ -68,6 +83,7 @@ describe('AllCasesGeneric ', () => {
       actionLicense: null,
       isLoading: false,
     });
+    useConnectorsMock.mockImplementation(() => ({ connectors: connectorsMock, loading: false }));
   });
 
   it('renders the first available status when hiddenStatus is given', () =>
diff --git a/x-pack/plugins/cases/public/components/all_cases/all_cases_generic.tsx b/x-pack/plugins/cases/public/components/all_cases/all_cases_generic.tsx
index 477ea27be99bff..72491a2bc1e319 100644
--- a/x-pack/plugins/cases/public/components/all_cases/all_cases_generic.tsx
+++ b/x-pack/plugins/cases/public/components/all_cases/all_cases_generic.tsx
@@ -37,6 +37,7 @@ import { CasesTableFilters } from './table_filters';
 import { EuiBasicTableOnChange } from './types';
 
 import { CasesTable } from './table';
+import { useConnectors } from '../../containers/configure/use_connectors';
 
 const ProgressLoader = styled(EuiProgress)`
   ${({ $isShow }: { $isShow: boolean }) =>
@@ -103,6 +104,7 @@ export const AllCasesGeneric = React.memo<AllCasesGenericProps>(
 
     // Post Comment to Case
     const { postComment, isLoading: isCommentUpdating } = usePostComment();
+    const { connectors } = useConnectors({ toastPermissionsErrors: false });
 
     const sorting = useMemo(
       () => ({
@@ -203,6 +205,7 @@ export const AllCasesGeneric = React.memo<AllCasesGenericProps>(
       refreshCases,
       showActions,
       userCanCrud,
+      connectors,
     });
 
     const itemIdToExpandedRowMap = useMemo(
diff --git a/x-pack/plugins/cases/public/components/all_cases/columns.test.tsx b/x-pack/plugins/cases/public/components/all_cases/columns.test.tsx
index 0f0189f2d29c27..015ba877a27490 100644
--- a/x-pack/plugins/cases/public/components/all_cases/columns.test.tsx
+++ b/x-pack/plugins/cases/public/components/all_cases/columns.test.tsx
@@ -10,51 +10,69 @@ import { mount } from 'enzyme';
 
 import '../../common/mock/match_media';
 import { ExternalServiceColumn } from './columns';
-
 import { useGetCasesMockState } from '../../containers/mock';
+import { useKibana } from '../../common/lib/kibana';
+import { actionTypeRegistryMock } from '../../../../triggers_actions_ui/public/application/action_type_registry.mock';
+import { connectors } from '../configure_cases/__mock__';
 
-jest.mock('../../common/lib/kibana', () => {
-  const originalModule = jest.requireActual('../../common/lib/kibana');
-  return {
-    ...originalModule,
-    useKibana: () => ({
-      services: {
-        triggersActionsUi: {
-          actionTypeRegistry: {
-            get: jest.fn().mockReturnValue({
-              actionTypeTitle: '.jira',
-              iconClass: 'logoSecurity',
-            }),
-          },
-        },
-      },
-    }),
-  };
-});
+jest.mock('../../common/lib/kibana');
+const useKibanaMock = useKibana as jest.Mocked<typeof useKibana>;
 
 describe('ExternalServiceColumn ', () => {
+  const { createMockActionTypeModel } = actionTypeRegistryMock;
+
+  beforeAll(() => {
+    connectors.forEach((connector) =>
+      useKibanaMock().services.triggersActionsUi.actionTypeRegistry.register(
+        createMockActionTypeModel({ id: connector.actionTypeId, iconClass: 'logoSecurity' })
+      )
+    );
+  });
+
   it('Not pushed render', () => {
     const wrapper = mount(
-      <ExternalServiceColumn {...{ theCase: useGetCasesMockState.data.cases[0] }} />
+      <ExternalServiceColumn theCase={useGetCasesMockState.data.cases[0]} connectors={connectors} />
     );
     expect(
       wrapper.find(`[data-test-subj="case-table-column-external-notPushed"]`).last().exists()
     ).toBeTruthy();
   });
+
   it('Up to date', () => {
     const wrapper = mount(
-      <ExternalServiceColumn {...{ theCase: useGetCasesMockState.data.cases[1] }} />
+      <ExternalServiceColumn theCase={useGetCasesMockState.data.cases[1]} connectors={connectors} />
     );
     expect(
       wrapper.find(`[data-test-subj="case-table-column-external-upToDate"]`).last().exists()
     ).toBeTruthy();
   });
+
   it('Needs update', () => {
     const wrapper = mount(
-      <ExternalServiceColumn {...{ theCase: useGetCasesMockState.data.cases[2] }} />
+      <ExternalServiceColumn theCase={useGetCasesMockState.data.cases[2]} connectors={connectors} />
     );
     expect(
       wrapper.find(`[data-test-subj="case-table-column-external-requiresUpdate"]`).last().exists()
     ).toBeTruthy();
   });
+
+  it('it does not throw when accessing the icon if the connector type is not registered', () => {
+    // If the component throws the test will fail
+    expect(() =>
+      mount(
+        <ExternalServiceColumn
+          theCase={useGetCasesMockState.data.cases[2]}
+          connectors={[
+            {
+              id: 'none',
+              actionTypeId: '.none',
+              name: 'None',
+              config: {},
+              isPreconfigured: false,
+            },
+          ]}
+        />
+      )
+    ).not.toThrowError();
+  });
 });
diff --git a/x-pack/plugins/cases/public/components/all_cases/columns.tsx b/x-pack/plugins/cases/public/components/all_cases/columns.tsx
index 140dbf2f53c25c..8b755b0c60968e 100644
--- a/x-pack/plugins/cases/public/components/all_cases/columns.tsx
+++ b/x-pack/plugins/cases/public/components/all_cases/columns.tsx
@@ -21,7 +21,14 @@ import {
 import { RIGHT_ALIGNMENT } from '@elastic/eui/lib/services';
 import styled from 'styled-components';
 
-import { CaseStatuses, CaseType, DeleteCase, Case, SubCase } from '../../../common';
+import {
+  CaseStatuses,
+  CaseType,
+  DeleteCase,
+  Case,
+  SubCase,
+  ActionConnector,
+} from '../../../common';
 import { getEmptyTagValue } from '../empty_value';
 import { FormattedRelativePreferenceDate } from '../formatted_date';
 import { CaseDetailsHrefSchema, CaseDetailsLink, CasesNavigation } from '../links';
@@ -35,6 +42,7 @@ import { ConfirmDeleteCaseModal } from '../confirm_delete_case';
 import { useKibana } from '../../common/lib/kibana';
 import { StatusContextMenu } from '../case_action_bar/status_context_menu';
 import { TruncatedText } from '../truncated_text';
+import { getConnectorIcon } from '../utils';
 
 export type CasesColumns =
   | EuiTableActionsColumnType<Case>
@@ -66,6 +74,7 @@ export interface GetCasesColumn {
   refreshCases?: (a?: boolean) => void;
   showActions: boolean;
   userCanCrud: boolean;
+  connectors?: ActionConnector[];
 }
 export const useCasesColumns = ({
   caseDetailsNavigation,
@@ -77,6 +86,7 @@ export const useCasesColumns = ({
   refreshCases,
   showActions,
   userCanCrud,
+  connectors = [],
 }: GetCasesColumn): CasesColumns[] => {
   // Delete case
   const {
@@ -266,7 +276,7 @@ export const useCasesColumns = ({
       name: i18n.EXTERNAL_INCIDENT,
       render: (theCase: Case) => {
         if (theCase.id != null) {
-          return <ExternalServiceColumn theCase={theCase} />;
+          return <ExternalServiceColumn theCase={theCase} connectors={connectors} />;
         }
         return getEmptyTagValue();
       },
@@ -325,6 +335,7 @@ export const useCasesColumns = ({
 
 interface Props {
   theCase: Case;
+  connectors: ActionConnector[];
 }
 
 const IconWrapper = styled.span`
@@ -335,26 +346,31 @@ const IconWrapper = styled.span`
     width: 20px !important;
   }
 `;
-export const ExternalServiceColumn: React.FC<Props> = ({ theCase }) => {
+
+export const ExternalServiceColumn: React.FC<Props> = ({ theCase, connectors }) => {
   const { triggersActionsUi } = useKibana().services;
 
   if (theCase.externalService == null) {
     return renderStringField(i18n.NOT_PUSHED, `case-table-column-external-notPushed`);
   }
 
+  const lastPushedConnector: ActionConnector | undefined = connectors.find(
+    (connector) => connector.id === theCase.externalService?.connectorId
+  );
   const lastCaseUpdate = theCase.updatedAt != null ? new Date(theCase.updatedAt) : null;
   const lastCasePush =
     theCase.externalService?.pushedAt != null ? new Date(theCase.externalService?.pushedAt) : null;
   const hasDataToPush =
     lastCasePush === null ||
     (lastCaseUpdate != null && lastCasePush.getTime() < lastCaseUpdate?.getTime());
+
   return (
     <p>
       <IconWrapper>
         <EuiIcon
           size="original"
           title={theCase.externalService?.connectorName}
-          type={triggersActionsUi.actionTypeRegistry.get(theCase.connector.type)?.iconClass ?? ''}
+          type={getConnectorIcon(triggersActionsUi, lastPushedConnector?.actionTypeId)}
         />
       </IconWrapper>
       <EuiLink
diff --git a/x-pack/plugins/cases/public/components/all_cases/index.test.tsx b/x-pack/plugins/cases/public/components/all_cases/index.test.tsx
index 4c15550f3ce3c6..9e6928d43c8625 100644
--- a/x-pack/plugins/cases/public/components/all_cases/index.test.tsx
+++ b/x-pack/plugins/cases/public/components/all_cases/index.test.tsx
@@ -9,9 +9,16 @@ import React from 'react';
 import { mount } from 'enzyme';
 import moment from 'moment-timezone';
 import { waitFor } from '@testing-library/react';
+import { renderHook } from '@testing-library/react-hooks';
+
 import '../../common/mock/match_media';
 import { TestProviders } from '../../common/mock';
-import { casesStatus, useGetCasesMockState, collectionCase } from '../../containers/mock';
+import {
+  casesStatus,
+  useGetCasesMockState,
+  collectionCase,
+  connectorsMock,
+} from '../../containers/mock';
 
 import { CaseStatuses, CaseType, SECURITY_SOLUTION_OWNER, StatusAll } from '../../../common';
 import { getEmptyTagValue } from '../empty_value';
@@ -20,21 +27,30 @@ import { useGetCases } from '../../containers/use_get_cases';
 import { useGetCasesStatus } from '../../containers/use_get_cases_status';
 import { useUpdateCases } from '../../containers/use_bulk_update_case';
 import { useGetActionLicense } from '../../containers/use_get_action_license';
+import { useConnectors } from '../../containers/configure/use_connectors';
+import { useKibana } from '../../common/lib/kibana';
 import { AllCasesGeneric as AllCases } from './all_cases_generic';
 import { AllCasesProps } from '.';
 import { CasesColumns, GetCasesColumn, useCasesColumns } from './columns';
-import { renderHook } from '@testing-library/react-hooks';
+import { actionTypeRegistryMock } from '../../../../triggers_actions_ui/public/application/action_type_registry.mock';
+import { triggersActionsUiMock } from '../../../../triggers_actions_ui/public/mocks';
+
 jest.mock('../../containers/use_bulk_update_case');
 jest.mock('../../containers/use_delete_cases');
 jest.mock('../../containers/use_get_cases');
 jest.mock('../../containers/use_get_cases_status');
 jest.mock('../../containers/use_get_action_license');
+jest.mock('../../containers/configure/use_connectors');
 
 const useDeleteCasesMock = useDeleteCases as jest.Mock;
 const useGetCasesMock = useGetCases as jest.Mock;
 const useGetCasesStatusMock = useGetCasesStatus as jest.Mock;
 const useUpdateCasesMock = useUpdateCases as jest.Mock;
 const useGetActionLicenseMock = useGetActionLicense as jest.Mock;
+const useKibanaMock = useKibana as jest.Mocked<typeof useKibana>;
+const useConnectorsMock = useConnectors as jest.Mock;
+
+const mockTriggersActionsUiService = triggersActionsUiMock.createStart();
 
 jest.mock('../../common/lib/kibana', () => {
   const originalModule = jest.requireActual('../../common/lib/kibana');
@@ -42,14 +58,7 @@ jest.mock('../../common/lib/kibana', () => {
     ...originalModule,
     useKibana: () => ({
       services: {
-        triggersActionsUi: {
-          actionTypeRegistry: {
-            get: jest.fn().mockReturnValue({
-              actionTypeTitle: '.jira',
-              iconClass: 'logoSecurity',
-            }),
-          },
-        },
+        triggersActionsUi: mockTriggersActionsUiService,
       },
     }),
   };
@@ -139,6 +148,16 @@ describe('AllCasesGeneric', () => {
     userCanCrud: true,
   };
 
+  const { createMockActionTypeModel } = actionTypeRegistryMock;
+
+  beforeAll(() => {
+    connectorsMock.forEach((connector) =>
+      useKibanaMock().services.triggersActionsUi.actionTypeRegistry.register(
+        createMockActionTypeModel({ id: connector.actionTypeId, iconClass: 'logoSecurity' })
+      )
+    );
+  });
+
   beforeEach(() => {
     jest.clearAllMocks();
     useUpdateCasesMock.mockReturnValue(defaultUpdateCases);
@@ -146,6 +165,7 @@ describe('AllCasesGeneric', () => {
     useDeleteCasesMock.mockReturnValue(defaultDeleteCases);
     useGetCasesStatusMock.mockReturnValue(defaultCasesStatus);
     useGetActionLicenseMock.mockReturnValue(defaultActionLicense);
+    useConnectorsMock.mockImplementation(() => ({ connectors: connectorsMock, loading: false }));
     moment.tz.setDefault('UTC');
   });
 
diff --git a/x-pack/plugins/cases/public/components/configure_cases/connectors_dropdown.test.tsx b/x-pack/plugins/cases/public/components/configure_cases/connectors_dropdown.test.tsx
index 141be31a093f1e..8eae574776e2e9 100644
--- a/x-pack/plugins/cases/public/components/configure_cases/connectors_dropdown.test.tsx
+++ b/x-pack/plugins/cases/public/components/configure_cases/connectors_dropdown.test.tsx
@@ -13,6 +13,7 @@ import { ConnectorsDropdown, Props } from './connectors_dropdown';
 import { TestProviders } from '../../common/mock';
 import { connectors } from './__mock__';
 import { useKibana } from '../../common/lib/kibana';
+import { actionTypeRegistryMock } from '../../../../triggers_actions_ui/public/application/action_type_registry.mock';
 
 jest.mock('../../common/lib/kibana');
 const useKibanaMock = useKibana as jest.Mocked<typeof useKibana>;
@@ -27,11 +28,14 @@ describe('ConnectorsDropdown', () => {
     selectedConnector: 'none',
   };
 
+  const { createMockActionTypeModel } = actionTypeRegistryMock;
+
   beforeAll(() => {
-    useKibanaMock().services.triggersActionsUi.actionTypeRegistry.get = jest.fn().mockReturnValue({
-      actionTypeTitle: '.servicenow',
-      iconClass: 'logoSecurity',
-    });
+    connectors.forEach((connector) =>
+      useKibanaMock().services.triggersActionsUi.actionTypeRegistry.register(
+        createMockActionTypeModel({ id: connector.actionTypeId, iconClass: 'logoSecurity' })
+      )
+    );
     wrapper = mount(<ConnectorsDropdown {...props} />, { wrappingComponent: TestProviders });
   });
 
@@ -219,4 +223,26 @@ describe('ConnectorsDropdown', () => {
       options.some((o) => o['data-test-subj'] === 'dropdown-connector-servicenow-sir')
     ).toBeFalsy();
   });
+
+  test('it does not throw when accessing the icon if the connector type is not registered', () => {
+    expect(() =>
+      mount(
+        <ConnectorsDropdown
+          {...props}
+          connectors={[
+            {
+              id: 'none',
+              actionTypeId: '.none',
+              name: 'None',
+              config: {},
+              isPreconfigured: false,
+            },
+          ]}
+        />,
+        {
+          wrappingComponent: TestProviders,
+        }
+      )
+    ).not.toThrowError();
+  });
 });
diff --git a/x-pack/plugins/cases/public/components/configure_cases/connectors_dropdown.tsx b/x-pack/plugins/cases/public/components/configure_cases/connectors_dropdown.tsx
index d26ec06d696fcf..3cab2afd41f41b 100644
--- a/x-pack/plugins/cases/public/components/configure_cases/connectors_dropdown.tsx
+++ b/x-pack/plugins/cases/public/components/configure_cases/connectors_dropdown.tsx
@@ -13,6 +13,7 @@ import { ConnectorTypes } from '../../../common';
 import { ActionConnector } from '../../containers/configure/types';
 import * as i18n from './translations';
 import { useKibana } from '../../common/lib/kibana';
+import { getConnectorIcon } from '../utils';
 
 export interface Props {
   connectors: ActionConnector[];
@@ -81,10 +82,7 @@ const ConnectorsDropdownComponent: React.FC<Props> = ({
               <EuiFlexGroup gutterSize="none" alignItems="center" responsive={false}>
                 <EuiFlexItem grow={false}>
                   <EuiIconExtended
-                    type={
-                      triggersActionsUi.actionTypeRegistry.get(connector.actionTypeId)?.iconClass ??
-                      ''
-                    }
+                    type={getConnectorIcon(triggersActionsUi, connector.actionTypeId)}
                     size={ICON_SIZE}
                   />
                 </EuiFlexItem>
diff --git a/x-pack/plugins/cases/public/components/connectors/card.test.tsx b/x-pack/plugins/cases/public/components/connectors/card.test.tsx
new file mode 100644
index 00000000000000..b5d70a67819164
--- /dev/null
+++ b/x-pack/plugins/cases/public/components/connectors/card.test.tsx
@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { mount } from 'enzyme';
+
+import { ConnectorTypes } from '../../../common';
+import { useKibana } from '../../common/lib/kibana';
+import { actionTypeRegistryMock } from '../../../../triggers_actions_ui/public/application/action_type_registry.mock';
+import { connectors } from '../configure_cases/__mock__';
+import { ConnectorCard } from './card';
+
+jest.mock('../../common/lib/kibana');
+const useKibanaMock = useKibana as jest.Mocked<typeof useKibana>;
+
+describe('ConnectorCard ', () => {
+  const { createMockActionTypeModel } = actionTypeRegistryMock;
+
+  beforeAll(() => {
+    connectors.forEach((connector) =>
+      useKibanaMock().services.triggersActionsUi.actionTypeRegistry.register(
+        createMockActionTypeModel({ id: connector.actionTypeId, iconClass: 'logoSecurity' })
+      )
+    );
+  });
+
+  it('it does not throw when accessing the icon if the connector type is not registered', () => {
+    expect(() =>
+      mount(
+        <ConnectorCard
+          connectorType={ConnectorTypes.none}
+          title="None"
+          listItems={[]}
+          isLoading={false}
+        />
+      )
+    ).not.toThrowError();
+  });
+});
diff --git a/x-pack/plugins/cases/public/components/connectors/card.tsx b/x-pack/plugins/cases/public/components/connectors/card.tsx
index b27c7207e7b8a3..86cd90dafb3763 100644
--- a/x-pack/plugins/cases/public/components/connectors/card.tsx
+++ b/x-pack/plugins/cases/public/components/connectors/card.tsx
@@ -11,6 +11,7 @@ import styled from 'styled-components';
 
 import { ConnectorTypes } from '../../../common';
 import { useKibana } from '../../common/lib/kibana';
+import { getConnectorIcon } from '../utils';
 
 interface ConnectorCardProps {
   connectorType: ConnectorTypes;
@@ -47,16 +48,13 @@ const ConnectorCardDisplay: React.FC<ConnectorCardProps> = ({
     ),
     [listItems]
   );
+
   const icon = useMemo(
-    () => (
-      <EuiIcon
-        size="xl"
-        type={triggersActionsUi.actionTypeRegistry.get(`${connectorType}`)?.iconClass ?? ''}
-      />
-    ),
+    () => <EuiIcon size="xl" type={getConnectorIcon(triggersActionsUi, connectorType)} />,
     // eslint-disable-next-line react-hooks/exhaustive-deps
     [connectorType]
   );
+
   return (
     <>
       {isLoading && <EuiLoadingSpinner data-test-subj="connector-card-loading" />}
diff --git a/x-pack/plugins/cases/public/components/create/connector.test.tsx b/x-pack/plugins/cases/public/components/create/connector.test.tsx
index bc6d5c8717eced..1b480c3f5d78a7 100644
--- a/x-pack/plugins/cases/public/components/create/connector.test.tsx
+++ b/x-pack/plugins/cases/public/components/create/connector.test.tsx
@@ -21,20 +21,18 @@ import { schema, FormProps } from './schema';
 import { TestProviders } from '../../common/mock';
 import { useCaseConfigure } from '../../containers/configure/use_configure';
 import { useCaseConfigureResponse } from '../configure_cases/__mock__';
+import { triggersActionsUiMock } from '../../../../triggers_actions_ui/public/mocks';
+import { actionTypeRegistryMock } from '../../../../triggers_actions_ui/public/application/action_type_registry.mock';
+import { useKibana } from '../../common/lib/kibana';
+
+const mockTriggersActionsUiService = triggersActionsUiMock.createStart();
 
 jest.mock('../../common/lib/kibana', () => ({
   useKibana: () => ({
     services: {
       notifications: {},
       http: {},
-      triggersActionsUi: {
-        actionTypeRegistry: {
-          get: jest.fn().mockReturnValue({
-            actionTypeTitle: 'test',
-            iconClass: 'logoSecurity',
-          }),
-        },
-      },
+      triggersActionsUi: mockTriggersActionsUiService,
     },
   }),
 }));
@@ -48,6 +46,7 @@ const useGetIncidentTypesMock = useGetIncidentTypes as jest.Mock;
 const useGetSeverityMock = useGetSeverity as jest.Mock;
 const useGetChoicesMock = useGetChoices as jest.Mock;
 const useCaseConfigureMock = useCaseConfigure as jest.Mock;
+const useKibanaMock = useKibana as jest.Mocked<typeof useKibana>;
 
 const useGetIncidentTypesResponse = {
   isLoading: false,
@@ -87,6 +86,16 @@ describe('Connector', () => {
     return <Form form={form}>{children}</Form>;
   };
 
+  const { createMockActionTypeModel } = actionTypeRegistryMock;
+
+  beforeAll(() => {
+    connectorsMock.forEach((connector) =>
+      useKibanaMock().services.triggersActionsUi.actionTypeRegistry.register(
+        createMockActionTypeModel({ id: connector.actionTypeId, iconClass: 'logoSecurity' })
+      )
+    );
+  });
+
   beforeEach(() => {
     jest.resetAllMocks();
     useGetIncidentTypesMock.mockReturnValue(useGetIncidentTypesResponse);
diff --git a/x-pack/plugins/cases/public/components/utils.test.ts b/x-pack/plugins/cases/public/components/utils.test.ts
new file mode 100644
index 00000000000000..496dc8d8c80663
--- /dev/null
+++ b/x-pack/plugins/cases/public/components/utils.test.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { actionTypeRegistryMock } from '../../../triggers_actions_ui/public/application/action_type_registry.mock';
+import { triggersActionsUiMock } from '../../../triggers_actions_ui/public/mocks';
+import { getConnectorIcon } from './utils';
+
+describe('Utils', () => {
+  describe('getConnectorIcon', () => {
+    const { createMockActionTypeModel } = actionTypeRegistryMock;
+    const mockTriggersActionsUiService = triggersActionsUiMock.createStart();
+    mockTriggersActionsUiService.actionTypeRegistry.register(
+      createMockActionTypeModel({ id: '.test', iconClass: 'test' })
+    );
+
+    it('it returns the correct icon class', () => {
+      expect(getConnectorIcon(mockTriggersActionsUiService, '.test')).toBe('test');
+    });
+
+    it('it returns an empty string if the type is undefined', () => {
+      expect(getConnectorIcon(mockTriggersActionsUiService)).toBe('');
+    });
+
+    it('it returns an empty string if the type is not registered', () => {
+      expect(getConnectorIcon(mockTriggersActionsUiService, '.not-registered')).toBe('');
+    });
+
+    it('it returns an empty string if it throws', () => {
+      mockTriggersActionsUiService.actionTypeRegistry.get = () => {
+        throw new Error();
+      };
+
+      expect(getConnectorIcon(mockTriggersActionsUiService, '.not-registered')).toBe('');
+    });
+  });
+});
diff --git a/x-pack/plugins/cases/public/components/utils.ts b/x-pack/plugins/cases/public/components/utils.ts
index 033529c27a2d40..5f7480cb84f7c5 100644
--- a/x-pack/plugins/cases/public/components/utils.ts
+++ b/x-pack/plugins/cases/public/components/utils.ts
@@ -5,8 +5,10 @@
  * 2.0.
  */
 
+import { IconType } from '@elastic/eui';
 import { ConnectorTypes } from '../../common';
 import { FieldConfig, ValidationConfig } from '../common/shared_imports';
+import { StartPlugins } from '../types';
 import { connectorValidator as swimlaneConnectorValidator } from './connectors/swimlane/validator';
 import { CaseActionConnector } from './types';
 
@@ -41,3 +43,28 @@ export const getConnectorsFormValidators = ({
     },
   ],
 });
+
+export const getConnectorIcon = (
+  triggersActionsUi: StartPlugins['triggersActionsUi'],
+  type?: string
+): IconType => {
+  /**
+   * triggersActionsUi.actionTypeRegistry.get will throw an error if the type is not registered.
+   * This will break Kibana if not handled properly.
+   */
+  const emptyResponse = '';
+
+  if (type == null) {
+    return emptyResponse;
+  }
+
+  try {
+    if (triggersActionsUi.actionTypeRegistry.has(type)) {
+      return triggersActionsUi.actionTypeRegistry.get(type).iconClass;
+    }
+  } catch {
+    return emptyResponse;
+  }
+
+  return emptyResponse;
+};
diff --git a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/components/table/table.test.tsx b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/components/table/table.test.tsx
index b122155d8c93a4..f3079155f7eb5d 100644
--- a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/components/table/table.test.tsx
+++ b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/components/table/table.test.tsx
@@ -134,7 +134,7 @@ describe('Background Search Session Management Table', () => {
       expect(table.find('tbody td').map((node) => node.text())).toMatchInlineSnapshot(`
         Array [
           "App",
-          "Namevery background search  ",
+          "Namevery background search ",
           "# Searches0",
           "StatusExpired",
           "Created2 Dec, 2020, 00:19:32",
diff --git a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/get_columns.test.tsx b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/get_columns.test.tsx
index f46ded96d877c4..4764e273e5a686 100644
--- a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/get_columns.test.tsx
+++ b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/get_columns.test.tsx
@@ -161,6 +161,70 @@ describe('Search Sessions Management table column factory', () => {
 
       expect(name.text()).toBe('Cool mock session');
     });
+
+    describe('old version warning', () => {
+      const currentKibanaVersion = '7.14.0';
+      const olderKibanaVersion = '7.13.0';
+      let hasRenderedVersionWarning: (partialSession: Partial<UISession>) => boolean;
+      beforeEach(() => {
+        const [, nameColumn] = getColumns(
+          mockCoreStart,
+          mockPluginsSetup,
+          api,
+          mockConfig,
+          tz,
+          handleAction,
+          currentKibanaVersion
+        ) as Array<EuiTableFieldDataColumnType<UISession>>;
+
+        hasRenderedVersionWarning = (partialSession: Partial<UISession>): boolean => {
+          const session: UISession = {
+            ...mockSession,
+            ...partialSession,
+          };
+          const node = mount(
+            nameColumn.render!(session.name, session) as ReactElement
+          ).getDOMNode();
+          return !!node.querySelector('[data-test-subj="versionIncompatibleWarningTestSubj"]');
+        };
+      });
+
+      test("don't render warning for the same version when can restore", () => {
+        expect(
+          hasRenderedVersionWarning({
+            version: currentKibanaVersion,
+            status: SearchSessionStatus.COMPLETE,
+          })
+        ).toBe(false);
+      });
+
+      test("don't render warning for the same version when can't restore", () => {
+        expect(
+          hasRenderedVersionWarning({
+            version: currentKibanaVersion,
+            status: SearchSessionStatus.EXPIRED,
+          })
+        ).toBe(false);
+      });
+
+      test('render a warning for a different version when can restore', () => {
+        expect(
+          hasRenderedVersionWarning({
+            version: olderKibanaVersion,
+            status: SearchSessionStatus.COMPLETE,
+          })
+        ).toBe(true);
+      });
+
+      test("don't render a warning for a different version when can't restore", () => {
+        expect(
+          hasRenderedVersionWarning({
+            version: olderKibanaVersion,
+            status: SearchSessionStatus.EXPIRED,
+          })
+        ).toBe(false);
+      });
+    });
   });
 
   // Num of searches column
diff --git a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/get_columns.tsx b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/get_columns.tsx
index 9583fc4b843a9b..865a2c9754747f 100644
--- a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/get_columns.tsx
+++ b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/get_columns.tsx
@@ -103,12 +103,18 @@ export const getColumns = (
             />
           </>
         );
+
+        // show version warning only if:
+        // 1. the session was created in a different version of Kibana
+        // AND
+        // 2. if still can restore this session: it has IN_PROGRESS or COMPLETE status.
         const versionIncompatibleWarning =
-          isRestorable && version === kibanaVersion ? null : (
+          isRestorable && version !== kibanaVersion ? (
             <>
               {' '}
               <EuiIconTip
                 type="alert"
+                iconProps={{ 'data-test-subj': 'versionIncompatibleWarningTestSubj' }}
                 content={
                   <FormattedMessage
                     id="xpack.data.mgmt.searchSessions.table.versionIncompatibleWarning"
@@ -117,7 +123,8 @@ export const getColumns = (
                 }
               />
             </>
-          );
+          ) : null;
+
         return (
           <RedirectAppLinks application={core.application}>
             {/* eslint-disable-next-line @elastic/eui/href-or-on-click */}
diff --git a/x-pack/plugins/data_visualizer/kibana.json b/x-pack/plugins/data_visualizer/kibana.json
index 01aca7c2bbaee2..e7f2d71313abf0 100644
--- a/x-pack/plugins/data_visualizer/kibana.json
+++ b/x-pack/plugins/data_visualizer/kibana.json
@@ -23,7 +23,8 @@
     "home",
     "kibanaReact",
     "maps",
-    "esUiShared"
+    "esUiShared",
+    "fieldFormats"
   ],
   "extraPublicDirs": [
     "common"
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/services/time_buckets.js b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/services/time_buckets.js
index 6a68ebeef7c30c..5d54b6c936fb25 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/services/time_buckets.js
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/services/time_buckets.js
@@ -5,7 +5,8 @@
  * 2.0.
  */
 
-import { FIELD_FORMAT_IDS, UI_SETTINGS } from '../../../../../../../src/plugins/data/common';
+import { FIELD_FORMAT_IDS } from '../../../../../../../src/plugins/field_formats/common';
+import { UI_SETTINGS } from '../../../../../../../src/plugins/data/common';
 import { ary, assign, isPlainObject, isString, sortBy } from 'lodash';
 import moment from 'moment';
 import dateMath from '@elastic/datemath';
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawler_status_banner.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawler_status_banner.test.tsx
new file mode 100644
index 00000000000000..1be4c27037d1fb
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawler_status_banner.test.tsx
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { setMockValues } from '../../../../__mocks__/kea_logic';
+
+import React from 'react';
+
+import { shallow } from 'enzyme';
+
+import { EuiCallOut } from '@elastic/eui';
+
+import { CrawlerStatus } from '../types';
+
+import { CrawlerStatusBanner } from './crawler_status_banner';
+
+describe('CrawlerStatusBanner', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  [(CrawlerStatus.Starting, CrawlerStatus.Running, CrawlerStatus.Canceling)].forEach((status) => {
+    describe(`when the status is ${status}`, () => {
+      it('renders a callout', () => {
+        setMockValues({
+          mostRecentCrawlRequestStatus: status,
+        });
+
+        const wrapper = shallow(<CrawlerStatusBanner />);
+
+        expect(wrapper.find(EuiCallOut)).toHaveLength(1);
+      });
+    });
+  });
+
+  [
+    CrawlerStatus.Success,
+    CrawlerStatus.Failed,
+    CrawlerStatus.Canceled,
+    CrawlerStatus.Pending,
+    CrawlerStatus.Suspended,
+    CrawlerStatus.Suspending,
+  ].forEach((status) => {
+    describe(`when the status is ${status}`, () => {
+      it('does not render a banner/callout', () => {
+        setMockValues({
+          mostRecentCrawlRequestStatus: status,
+        });
+
+        const wrapper = shallow(<CrawlerStatusBanner />);
+
+        expect(wrapper.isEmptyRender()).toBe(true);
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawler_status_banner.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawler_status_banner.tsx
new file mode 100644
index 00000000000000..833db286fc2e57
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawler_status_banner.tsx
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { useValues } from 'kea';
+
+import { EuiCallOut } from '@elastic/eui';
+
+import { i18n } from '@kbn/i18n';
+
+import { CrawlerOverviewLogic } from '../crawler_overview_logic';
+import { CrawlerStatus } from '../types';
+
+export const CrawlerStatusBanner: React.FC = () => {
+  const { mostRecentCrawlRequestStatus } = useValues(CrawlerOverviewLogic);
+  if (
+    mostRecentCrawlRequestStatus === CrawlerStatus.Running ||
+    mostRecentCrawlRequestStatus === CrawlerStatus.Starting ||
+    mostRecentCrawlRequestStatus === CrawlerStatus.Canceling
+  ) {
+    return (
+      <EuiCallOut
+        iconType="iInCircle"
+        title={i18n.translate(
+          'xpack.enterpriseSearch.appSearch.crawler.crawlerStatusBanner.changesCalloutTitle',
+          {
+            defaultMessage:
+              "Changes you make now won't take effect until the start of your next crawl.",
+          }
+        )}
+      />
+    );
+  }
+  return null;
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawler_status_indicator/crawler_status_indicator.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawler_status_indicator/crawler_status_indicator.test.tsx
new file mode 100644
index 00000000000000..9d585789d8e50b
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawler_status_indicator/crawler_status_indicator.test.tsx
@@ -0,0 +1,156 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { setMockActions, setMockValues } from '../../../../../__mocks__/kea_logic';
+
+import React from 'react';
+
+import { shallow } from 'enzyme';
+
+import { EuiButton } from '@elastic/eui';
+
+import { CrawlerDomain, CrawlerStatus } from '../../types';
+
+import { CrawlerStatusIndicator } from './crawler_status_indicator';
+import { StopCrawlPopoverContextMenu } from './stop_crawl_popover_context_menu';
+
+const MOCK_VALUES = {
+  domains: [{}, {}] as CrawlerDomain[],
+  mostRecentCrawlRequestStatus: CrawlerStatus.Success,
+};
+
+const MOCK_ACTIONS = {
+  startCrawl: jest.fn(),
+  stopCrawl: jest.fn(),
+};
+
+describe('CrawlerStatusIndicator', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    setMockActions(MOCK_ACTIONS);
+  });
+
+  describe('when status is not a valid status', () => {
+    it('is disabled', () => {
+      // this tests a codepath that should be impossible to reach, status should always be a CrawlerStatus
+      // but we use a switch statement and need to test the default case for this to recieve 100% coverage
+      setMockValues({
+        ...MOCK_VALUES,
+        mostRecentCrawlRequestStatus: null,
+      });
+
+      const wrapper = shallow(<CrawlerStatusIndicator />);
+      expect(wrapper.is(EuiButton)).toEqual(true);
+      expect(wrapper.render().text()).toContain('Start a crawl');
+      expect(wrapper.prop('disabled')).toEqual(true);
+    });
+  });
+
+  describe('when there are no domains', () => {
+    it('is disabled', () => {
+      setMockValues({
+        ...MOCK_VALUES,
+        domains: [],
+      });
+
+      const wrapper = shallow(<CrawlerStatusIndicator />);
+      expect(wrapper.is(EuiButton)).toEqual(true);
+      expect(wrapper.render().text()).toContain('Start a crawl');
+      expect(wrapper.prop('disabled')).toEqual(true);
+    });
+  });
+
+  describe('when the status is success', () => {
+    it('renders an CrawlerStatusIndicator with a start crawl button', () => {
+      setMockValues({
+        ...MOCK_VALUES,
+        mostRecentCrawlRequestStatus: CrawlerStatus.Success,
+      });
+
+      const wrapper = shallow(<CrawlerStatusIndicator />);
+      expect(wrapper.is(EuiButton)).toEqual(true);
+      expect(wrapper.render().text()).toContain('Start a crawl');
+      expect(wrapper.prop('onClick')).toEqual(MOCK_ACTIONS.startCrawl);
+    });
+  });
+
+  [CrawlerStatus.Failed, CrawlerStatus.Canceled].forEach((status) => {
+    describe(`when the status is ready for retry: ${status}`, () => {
+      it('renders an CrawlerStatusIndicator with a retry crawl button', () => {
+        setMockValues({
+          ...MOCK_VALUES,
+          mostRecentCrawlRequestStatus: status,
+        });
+
+        const wrapper = shallow(<CrawlerStatusIndicator />);
+        expect(wrapper.is(EuiButton)).toEqual(true);
+        expect(wrapper.render().text()).toContain('Retry crawl');
+        expect(wrapper.prop('onClick')).toEqual(MOCK_ACTIONS.startCrawl);
+      });
+    });
+  });
+
+  [CrawlerStatus.Pending, CrawlerStatus.Suspended].forEach((status) => {
+    describe(`when the status is ${status}`, () => {
+      it('renders an CrawlerStatusIndicator with a pending indicator', () => {
+        setMockValues({
+          ...MOCK_VALUES,
+          mostRecentCrawlRequestStatus: status,
+        });
+
+        const wrapper = shallow(<CrawlerStatusIndicator />);
+        expect(wrapper.is(EuiButton)).toEqual(true);
+        expect(wrapper.render().text()).toContain('Pending...');
+        expect(wrapper.prop('disabled')).toEqual(true);
+        expect(wrapper.prop('isLoading')).toEqual(true);
+      });
+    });
+  });
+
+  describe('when the status is Starting', () => {
+    it('renders an appropriate CrawlerStatusIndicator', () => {
+      setMockValues({
+        ...MOCK_VALUES,
+        mostRecentCrawlRequestStatus: CrawlerStatus.Starting,
+      });
+
+      const wrapper = shallow(<CrawlerStatusIndicator />);
+      expect(wrapper.is(EuiButton)).toEqual(true);
+      expect(wrapper.render().text()).toContain('Starting...');
+      expect(wrapper.prop('isLoading')).toEqual(true);
+    });
+  });
+
+  describe('when the status is Running', () => {
+    it('renders a stop crawl popover menu', () => {
+      setMockValues({
+        ...MOCK_VALUES,
+        mostRecentCrawlRequestStatus: CrawlerStatus.Running,
+      });
+
+      const wrapper = shallow(<CrawlerStatusIndicator />);
+      expect(wrapper.is(StopCrawlPopoverContextMenu)).toEqual(true);
+      expect(wrapper.prop('stopCrawl')).toEqual(MOCK_ACTIONS.stopCrawl);
+    });
+  });
+
+  [CrawlerStatus.Canceling, CrawlerStatus.Suspending].forEach((status) => {
+    describe(`when the status is ${status}`, () => {
+      it('renders an CrawlerStatusIndicator with a stopping indicator', () => {
+        setMockValues({
+          ...MOCK_VALUES,
+          mostRecentCrawlRequestStatus: status,
+        });
+
+        const wrapper = shallow(<CrawlerStatusIndicator />);
+        expect(wrapper.is(EuiButton)).toEqual(true);
+        expect(wrapper.render().text()).toContain('Stopping...');
+        expect(wrapper.prop('isLoading')).toEqual(true);
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawler_status_indicator/crawler_status_indicator.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawler_status_indicator/crawler_status_indicator.tsx
new file mode 100644
index 00000000000000..c1b8ad20734443
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawler_status_indicator/crawler_status_indicator.tsx
@@ -0,0 +1,106 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { useActions, useValues } from 'kea';
+
+import { EuiButton } from '@elastic/eui';
+
+import { i18n } from '@kbn/i18n';
+
+import { CrawlerOverviewLogic } from '../../crawler_overview_logic';
+import { CrawlerStatus } from '../../types';
+
+import { StopCrawlPopoverContextMenu } from './stop_crawl_popover_context_menu';
+
+export const CrawlerStatusIndicator: React.FC = () => {
+  const { domains, mostRecentCrawlRequestStatus } = useValues(CrawlerOverviewLogic);
+  const { startCrawl, stopCrawl } = useActions(CrawlerOverviewLogic);
+
+  const disabledButton = (
+    <EuiButton disabled>
+      {i18n.translate(
+        'xpack.enterpriseSearch.appSearch.crawler.crawlerStatusIndicator.startACrawlButtonLabel',
+        {
+          defaultMessage: 'Start a crawl',
+        }
+      )}
+    </EuiButton>
+  );
+
+  if (domains.length === 0) {
+    return disabledButton;
+  }
+
+  switch (mostRecentCrawlRequestStatus) {
+    case CrawlerStatus.Success:
+      return (
+        <EuiButton fill onClick={startCrawl}>
+          {i18n.translate(
+            'xpack.enterpriseSearch.appSearch.crawler.crawlerStatusIndicator.startACrawlButtonLabel',
+            {
+              defaultMessage: 'Start a crawl',
+            }
+          )}
+        </EuiButton>
+      );
+    case CrawlerStatus.Failed:
+    case CrawlerStatus.Canceled:
+      return (
+        <EuiButton fill onClick={startCrawl}>
+          {i18n.translate(
+            'xpack.enterpriseSearch.appSearch.crawler.crawlerStatusIndicator.retryCrawlButtonLabel',
+            {
+              defaultMessage: 'Retry crawl',
+            }
+          )}
+        </EuiButton>
+      );
+    case CrawlerStatus.Pending:
+    case CrawlerStatus.Suspended:
+      return (
+        <EuiButton disabled isLoading>
+          {i18n.translate(
+            'xpack.enterpriseSearch.appSearch.crawler.crawlerStatusIndicator.pendingButtonLabel',
+            {
+              defaultMessage: 'Pending...',
+            }
+          )}
+        </EuiButton>
+      );
+    case CrawlerStatus.Starting:
+      return (
+        <EuiButton isLoading>
+          {i18n.translate(
+            'xpack.enterpriseSearch.appSearch.crawler.crawlerStatusIndicator.startingButtonLabel',
+            {
+              defaultMessage: 'Starting...',
+            }
+          )}
+        </EuiButton>
+      );
+    case CrawlerStatus.Running:
+      return <StopCrawlPopoverContextMenu stopCrawl={stopCrawl} />;
+    case CrawlerStatus.Canceling:
+    case CrawlerStatus.Suspending:
+      return (
+        <EuiButton isLoading fill>
+          {i18n.translate(
+            'xpack.enterpriseSearch.appSearch.crawler.crawlerStatusIndicator.stoppingButtonLabel',
+            {
+              defaultMessage: 'Stopping...',
+            }
+          )}
+        </EuiButton>
+      );
+    default:
+      // We should never get here, you would have to pass a CrawlerStatus option not covered
+      // in the switch cases above
+      return disabledButton;
+  }
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawler_status_indicator/stop_crawl_popover_context_menu.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawler_status_indicator/stop_crawl_popover_context_menu.test.tsx
new file mode 100644
index 00000000000000..096238faff9a09
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawler_status_indicator/stop_crawl_popover_context_menu.test.tsx
@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+
+import { shallow } from 'enzyme';
+
+import {
+  EuiButton,
+  EuiContextMenuItem,
+  EuiContextMenuPanel,
+  EuiPopover,
+  EuiResizeObserver,
+} from '@elastic/eui';
+
+import { mountWithIntl } from '../../../../../test_helpers';
+
+import { StopCrawlPopoverContextMenu } from './stop_crawl_popover_context_menu';
+
+const stopCrawl = jest.fn();
+
+describe('StopCrawlsPopoverContextMenu', () => {
+  it('is initially closed', () => {
+    const wrapper = shallow(<StopCrawlPopoverContextMenu stopCrawl={stopCrawl} />);
+
+    expect(wrapper.is(EuiPopover)).toBe(true);
+    expect(wrapper.prop('isOpen')).toEqual(false);
+  });
+
+  it('can be opened to stop crawls', () => {
+    const wrapper = mountWithIntl(<StopCrawlPopoverContextMenu stopCrawl={stopCrawl} />);
+
+    wrapper.find(EuiButton).simulate('click');
+
+    expect(wrapper.find(EuiPopover).prop('isOpen')).toEqual(true);
+
+    const menuItem = wrapper
+      .find(EuiContextMenuPanel)
+      .find(EuiResizeObserver)
+      .find(EuiContextMenuItem);
+
+    expect(menuItem).toHaveLength(1);
+
+    menuItem.simulate('click');
+
+    expect(stopCrawl).toHaveBeenCalled();
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawler_status_indicator/stop_crawl_popover_context_menu.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawler_status_indicator/stop_crawl_popover_context_menu.tsx
new file mode 100644
index 00000000000000..6c0e91995e2811
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/components/crawler_status_indicator/stop_crawl_popover_context_menu.tsx
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useState } from 'react';
+
+import {
+  EuiButton,
+  EuiContextMenuItem,
+  EuiContextMenuPanel,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiLoadingSpinner,
+  EuiPopover,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+interface StopCrawlPopoverContextMenuProps {
+  stopCrawl(): void;
+}
+
+export const StopCrawlPopoverContextMenu: React.FC<StopCrawlPopoverContextMenuProps> = ({
+  stopCrawl,
+  ...rest
+}) => {
+  const [isPopoverOpen, setPopover] = useState(false);
+
+  const togglePopover = () => setPopover(!isPopoverOpen);
+
+  const closePopover = () => setPopover(false);
+
+  return (
+    <EuiPopover
+      {...rest}
+      button={
+        <EuiButton
+          iconType="arrowDown"
+          iconSide="right"
+          onClick={togglePopover}
+          className="crawlInProgressButton"
+        >
+          <EuiFlexGroup alignItems="center" responsive={false} gutterSize="s">
+            <EuiFlexItem grow={false}>
+              <EuiLoadingSpinner size="m" />
+            </EuiFlexItem>
+            <EuiFlexItem>
+              {i18n.translate(
+                'xpack.enterpriseSearch.appSearch.crawler.crawlerStatusIndicator.crawlingButtonLabel',
+                {
+                  defaultMessage: 'Crawling...',
+                }
+              )}
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiButton>
+      }
+      isOpen={isPopoverOpen}
+      closePopover={closePopover}
+      panelPaddingSize="none"
+      anchorPosition="downLeft"
+    >
+      <EuiContextMenuPanel
+        items={[
+          <EuiContextMenuItem
+            key="cancel crawl"
+            icon="cross"
+            onClick={() => {
+              closePopover();
+              stopCrawl();
+            }}
+          >
+            {i18n.translate(
+              'xpack.enterpriseSearch.appSearch.crawler.crawlerStatusIndicator.cancelCrawlMenuItemLabel',
+              {
+                defaultMessage: 'Cancel Crawl',
+              }
+            )}
+          </EuiContextMenuItem>,
+        ]}
+      />
+    </EuiPopover>
+  );
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_overview.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_overview.test.tsx
index e46804a658803a..ae4fc6b04b002d 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_overview.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_overview.test.tsx
@@ -13,10 +13,14 @@ import React from 'react';
 
 import { shallow } from 'enzyme';
 
+import { getPageHeaderActions } from '../../../test_helpers';
+
 import { AddDomainFlyout } from './components/add_domain/add_domain_flyout';
 import { AddDomainForm } from './components/add_domain/add_domain_form';
 import { AddDomainFormSubmitButton } from './components/add_domain/add_domain_form_submit_button';
 import { CrawlRequestsTable } from './components/crawl_requests_table';
+import { CrawlerStatusBanner } from './components/crawler_status_banner';
+import { CrawlerStatusIndicator } from './components/crawler_status_indicator/crawler_status_indicator';
 import { DomainsTable } from './components/domains_table';
 import { CrawlerOverview } from './crawler_overview';
 import {
@@ -75,6 +79,7 @@ const crawlRequests: CrawlRequestFromServer[] = [
 describe('CrawlerOverview', () => {
   const mockActions = {
     fetchCrawlerData: jest.fn(),
+    getLatestCrawlRequests: jest.fn(),
   };
 
   const mockValues = {
@@ -88,12 +93,26 @@ describe('CrawlerOverview', () => {
     setMockActions(mockActions);
   });
 
-  it('calls fetchCrawlerData on page load', () => {
+  it('calls fetchCrawlerData and starts polling on page load', () => {
     setMockValues(mockValues);
 
     shallow(<CrawlerOverview />);
 
     expect(mockActions.fetchCrawlerData).toHaveBeenCalledTimes(1);
+    expect(mockActions.getLatestCrawlRequests).toHaveBeenCalledWith(false);
+  });
+
+  it('contains a crawler status banner', () => {
+    setMockValues(mockValues);
+    const wrapper = shallow(<CrawlerOverview />);
+
+    expect(wrapper.find(CrawlerStatusBanner)).toHaveLength(1);
+  });
+
+  it('contains a crawler status indicator', () => {
+    const wrapper = shallow(<CrawlerOverview />);
+
+    expect(getPageHeaderActions(wrapper).find(CrawlerStatusIndicator)).toHaveLength(1);
   });
 
   it('hides the domain and crawl request tables when there are no domains, and no crawl requests', () => {
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_overview.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_overview.tsx
index 1f676467a55038..c18c1a753d2478 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_overview.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_overview.tsx
@@ -21,6 +21,8 @@ import { AddDomainFlyout } from './components/add_domain/add_domain_flyout';
 import { AddDomainForm } from './components/add_domain/add_domain_form';
 import { AddDomainFormSubmitButton } from './components/add_domain/add_domain_form_submit_button';
 import { CrawlRequestsTable } from './components/crawl_requests_table';
+import { CrawlerStatusBanner } from './components/crawler_status_banner';
+import { CrawlerStatusIndicator } from './components/crawler_status_indicator/crawler_status_indicator';
 import { DomainsTable } from './components/domains_table';
 import { CRAWLER_TITLE } from './constants';
 import { CrawlerOverviewLogic } from './crawler_overview_logic';
@@ -28,18 +30,24 @@ import { CrawlerOverviewLogic } from './crawler_overview_logic';
 export const CrawlerOverview: React.FC = () => {
   const { crawlRequests, dataLoading, domains } = useValues(CrawlerOverviewLogic);
 
-  const { fetchCrawlerData } = useActions(CrawlerOverviewLogic);
+  const { fetchCrawlerData, getLatestCrawlRequests } = useActions(CrawlerOverviewLogic);
 
   useEffect(() => {
     fetchCrawlerData();
+    getLatestCrawlRequests(false);
   }, []);
 
   return (
     <AppSearchPageTemplate
       pageChrome={getEngineBreadcrumbs([CRAWLER_TITLE])}
-      pageHeader={{ pageTitle: CRAWLER_TITLE }}
+      pageHeader={{
+        pageTitle: CRAWLER_TITLE,
+        rightSideItems: [<CrawlerStatusIndicator />],
+      }}
       isLoading={dataLoading}
     >
+      <CrawlerStatusBanner />
+      <EuiSpacer size="l" />
       {domains.length > 0 ? (
         <>
           <EuiFlexGroup direction="row" alignItems="stretch">
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_overview_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_overview_logic.test.ts
index 6ec0cb0f26a78b..86f6e146313291 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_overview_logic.test.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_overview_logic.test.ts
@@ -23,15 +23,16 @@ import {
   CrawlerRules,
   CrawlerStatus,
   CrawlRequest,
-  CrawlRequestFromServer,
   CrawlRule,
 } from './types';
-import { crawlerDataServerToClient, crawlRequestServerToClient } from './utils';
+import { crawlerDataServerToClient } from './utils';
 
 const DEFAULT_VALUES: CrawlerOverviewValues = {
   crawlRequests: [],
   dataLoading: true,
   domains: [],
+  mostRecentCrawlRequestStatus: CrawlerStatus.Success,
+  timeoutId: null,
 };
 
 const DEFAULT_CRAWL_RULE: CrawlRule = {
@@ -55,36 +56,50 @@ const MOCK_SERVER_CRAWLER_DATA: CrawlerDataFromServer = {
   ],
 };
 
-const MOCK_SERVER_CRAWL_REQUESTS_DATA: CrawlRequestFromServer[] = [
-  {
-    id: '618d0e66abe97bc688328900',
-    status: CrawlerStatus.Pending,
-    created_at: 'Mon, 31 Aug 2020 17:00:00 +0000',
-    began_at: null,
-    completed_at: null,
-  },
-];
-
 const MOCK_CLIENT_CRAWLER_DATA = crawlerDataServerToClient(MOCK_SERVER_CRAWLER_DATA);
-const MOCK_CLIENT_CRAWL_REQUESTS_DATA = MOCK_SERVER_CRAWL_REQUESTS_DATA.map(
-  crawlRequestServerToClient
-);
 
 describe('CrawlerOverviewLogic', () => {
-  const { mount } = new LogicMounter(CrawlerOverviewLogic);
+  const { mount, unmount } = new LogicMounter(CrawlerOverviewLogic);
   const { http } = mockHttpValues;
   const { flashAPIErrors, flashSuccessToast } = mockFlashMessageHelpers;
 
   beforeEach(() => {
     jest.clearAllMocks();
+    jest.useFakeTimers(); // this should be run before every test to reset these mocks
     mount();
   });
 
+  afterAll(() => {
+    jest.useRealTimers();
+  });
+
   it('has expected default values', () => {
     expect(CrawlerOverviewLogic.values).toEqual(DEFAULT_VALUES);
   });
 
   describe('actions', () => {
+    describe('clearTimeoutId', () => {
+      it('clears the timeout in the logic', () => {
+        mount({
+          timeoutId: setTimeout(() => {}, 1),
+        });
+
+        CrawlerOverviewLogic.actions.clearTimeoutId();
+
+        expect(CrawlerOverviewLogic.values.timeoutId).toEqual(null);
+      });
+    });
+
+    describe('onCreateNewTimeout', () => {
+      it('sets the timeout in the logic', () => {
+        const timeout = setTimeout(() => {}, 1);
+
+        CrawlerOverviewLogic.actions.onCreateNewTimeout(timeout);
+
+        expect(CrawlerOverviewLogic.values.timeoutId).toEqual(timeout);
+      });
+    });
+
     describe('onReceiveCrawlerData', () => {
       const crawlerData: CrawlerData = {
         domains: [
@@ -139,42 +154,20 @@ describe('CrawlerOverviewLogic', () => {
     describe('fetchCrawlerData', () => {
       it('updates logic with data that has been converted from server to client', async () => {
         jest.spyOn(CrawlerOverviewLogic.actions, 'onReceiveCrawlerData');
-        // TODO this spyOn should be removed when crawl request polling is added
-        jest.spyOn(CrawlerOverviewLogic.actions, 'onReceiveCrawlRequests');
-
-        // TODO this first mock for MOCK_SERVER_CRAWL_REQUESTS_DATA should be removed when crawl request polling is added
-        http.get.mockReturnValueOnce(Promise.resolve(MOCK_SERVER_CRAWL_REQUESTS_DATA));
         http.get.mockReturnValueOnce(Promise.resolve(MOCK_SERVER_CRAWLER_DATA));
+
         CrawlerOverviewLogic.actions.fetchCrawlerData();
         await nextTick();
 
-        expect(http.get).toHaveBeenNthCalledWith(
-          1,
-          '/api/app_search/engines/some-engine/crawler/crawl_requests'
-        );
-        expect(CrawlerOverviewLogic.actions.onReceiveCrawlRequests).toHaveBeenCalledWith(
-          MOCK_CLIENT_CRAWL_REQUESTS_DATA
-        );
-
-        expect(http.get).toHaveBeenNthCalledWith(2, '/api/app_search/engines/some-engine/crawler');
+        expect(http.get).toHaveBeenCalledWith('/api/app_search/engines/some-engine/crawler');
         expect(CrawlerOverviewLogic.actions.onReceiveCrawlerData).toHaveBeenCalledWith(
           MOCK_CLIENT_CRAWLER_DATA
         );
       });
 
-      // TODO this test should be removed when crawl request polling is added
-      it('calls flashApiErrors when there is an error on the request for crawl results', async () => {
-        http.get.mockReturnValueOnce(Promise.reject('error'));
-        CrawlerOverviewLogic.actions.fetchCrawlerData();
-        await nextTick();
-
-        expect(flashAPIErrors).toHaveBeenCalledWith('error');
-      });
-
       it('calls flashApiErrors when there is an error on the request for crawler data', async () => {
-        // TODO this first mock for MOCK_SERVER_CRAWL_REQUESTS_DATA should be removed when crawl request polling is added
-        http.get.mockReturnValueOnce(Promise.resolve(MOCK_SERVER_CRAWL_REQUESTS_DATA));
         http.get.mockReturnValueOnce(Promise.reject('error'));
+
         CrawlerOverviewLogic.actions.fetchCrawlerData();
         await nextTick();
 
@@ -185,8 +178,8 @@ describe('CrawlerOverviewLogic', () => {
     describe('deleteDomain', () => {
       it('calls onReceiveCrawlerData with retrieved data that has been converted from server to client', async () => {
         jest.spyOn(CrawlerOverviewLogic.actions, 'onReceiveCrawlerData');
-
         http.delete.mockReturnValue(Promise.resolve(MOCK_SERVER_CRAWLER_DATA));
+
         CrawlerOverviewLogic.actions.deleteDomain({ id: '1234' } as CrawlerDomain);
         await nextTick();
 
@@ -204,11 +197,248 @@ describe('CrawlerOverviewLogic', () => {
 
       it('calls flashApiErrors when there is an error', async () => {
         http.delete.mockReturnValue(Promise.reject('error'));
+
         CrawlerOverviewLogic.actions.deleteDomain({ id: '1234' } as CrawlerDomain);
         await nextTick();
 
         expect(flashAPIErrors).toHaveBeenCalledWith('error');
       });
     });
+
+    describe('startCrawl', () => {
+      describe('success path', () => {
+        it('creates a new crawl request and then fetches the latest crawl requests', async () => {
+          jest.spyOn(CrawlerOverviewLogic.actions, 'getLatestCrawlRequests');
+          http.post.mockReturnValueOnce(Promise.resolve());
+
+          CrawlerOverviewLogic.actions.startCrawl();
+          await nextTick();
+
+          expect(http.post).toHaveBeenCalledWith(
+            '/api/app_search/engines/some-engine/crawler/crawl_requests'
+          );
+          expect(CrawlerOverviewLogic.actions.getLatestCrawlRequests).toHaveBeenCalled();
+        });
+      });
+
+      describe('on failure', () => {
+        it('flashes an error message', async () => {
+          http.post.mockReturnValueOnce(Promise.reject('error'));
+
+          CrawlerOverviewLogic.actions.startCrawl();
+          await nextTick();
+
+          expect(flashAPIErrors).toHaveBeenCalledWith('error');
+        });
+      });
+    });
+
+    describe('stopCrawl', () => {
+      describe('success path', () => {
+        it('stops the crawl starts and then fetches the latest crawl requests', async () => {
+          jest.spyOn(CrawlerOverviewLogic.actions, 'getLatestCrawlRequests');
+          http.post.mockReturnValueOnce(Promise.resolve());
+
+          CrawlerOverviewLogic.actions.stopCrawl();
+          await nextTick();
+
+          expect(http.post).toHaveBeenCalledWith(
+            '/api/app_search/engines/some-engine/crawler/crawl_requests/cancel'
+          );
+          expect(CrawlerOverviewLogic.actions.getLatestCrawlRequests).toHaveBeenCalled();
+        });
+      });
+
+      describe('on failure', () => {
+        it('flashes an error message', async () => {
+          jest.spyOn(CrawlerOverviewLogic.actions, 'getLatestCrawlRequests');
+          http.post.mockReturnValueOnce(Promise.reject('error'));
+
+          CrawlerOverviewLogic.actions.stopCrawl();
+          await nextTick();
+
+          expect(flashAPIErrors).toHaveBeenCalledWith('error');
+        });
+      });
+    });
+
+    describe('createNewTimeoutForCrawlRequests', () => {
+      it('saves the timeout ID in the logic', () => {
+        jest.spyOn(CrawlerOverviewLogic.actions, 'onCreateNewTimeout');
+        jest.spyOn(CrawlerOverviewLogic.actions, 'getLatestCrawlRequests');
+
+        CrawlerOverviewLogic.actions.createNewTimeoutForCrawlRequests(2000);
+
+        expect(setTimeout).toHaveBeenCalledWith(expect.any(Function), 2000);
+        expect(CrawlerOverviewLogic.actions.onCreateNewTimeout).toHaveBeenCalled();
+
+        jest.runAllTimers();
+
+        expect(CrawlerOverviewLogic.actions.getLatestCrawlRequests).toHaveBeenCalled();
+      });
+
+      it('clears a timeout if one already exists', () => {
+        const timeoutId = setTimeout(() => {}, 1);
+        mount({
+          timeoutId,
+        });
+
+        CrawlerOverviewLogic.actions.createNewTimeoutForCrawlRequests(2000);
+
+        expect(clearTimeout).toHaveBeenCalledWith(timeoutId);
+      });
+    });
+
+    describe('getLatestCrawlRequests', () => {
+      describe('on success', () => {
+        [
+          CrawlerStatus.Pending,
+          CrawlerStatus.Starting,
+          CrawlerStatus.Running,
+          CrawlerStatus.Canceling,
+        ].forEach((status) => {
+          it(`creates a new timeout for status ${status}`, async () => {
+            jest.spyOn(CrawlerOverviewLogic.actions, 'createNewTimeoutForCrawlRequests');
+            http.get.mockReturnValueOnce(Promise.resolve([{ status }]));
+
+            CrawlerOverviewLogic.actions.getLatestCrawlRequests();
+            await nextTick();
+
+            expect(
+              CrawlerOverviewLogic.actions.createNewTimeoutForCrawlRequests
+            ).toHaveBeenCalled();
+          });
+        });
+
+        [CrawlerStatus.Success, CrawlerStatus.Failed, CrawlerStatus.Canceled].forEach((status) => {
+          it(`clears the timeout and fetches data for status ${status}`, async () => {
+            jest.spyOn(CrawlerOverviewLogic.actions, 'clearTimeoutId');
+            jest.spyOn(CrawlerOverviewLogic.actions, 'fetchCrawlerData');
+            http.get.mockReturnValueOnce(Promise.resolve([{ status }]));
+
+            CrawlerOverviewLogic.actions.getLatestCrawlRequests();
+            await nextTick();
+
+            expect(CrawlerOverviewLogic.actions.clearTimeoutId).toHaveBeenCalled();
+            expect(CrawlerOverviewLogic.actions.fetchCrawlerData).toHaveBeenCalled();
+          });
+
+          it(`optionally supresses fetching data for status ${status}`, async () => {
+            jest.spyOn(CrawlerOverviewLogic.actions, 'clearTimeoutId');
+            jest.spyOn(CrawlerOverviewLogic.actions, 'fetchCrawlerData');
+            http.get.mockReturnValueOnce(Promise.resolve([{ status }]));
+
+            CrawlerOverviewLogic.actions.getLatestCrawlRequests(false);
+            await nextTick();
+
+            expect(CrawlerOverviewLogic.actions.clearTimeoutId).toHaveBeenCalled();
+            expect(CrawlerOverviewLogic.actions.fetchCrawlerData).toHaveBeenCalledTimes(0);
+          });
+        });
+      });
+
+      describe('on failure', () => {
+        it('creates a new timeout', async () => {
+          jest.spyOn(CrawlerOverviewLogic.actions, 'createNewTimeoutForCrawlRequests');
+          http.get.mockReturnValueOnce(Promise.reject());
+
+          CrawlerOverviewLogic.actions.getLatestCrawlRequests();
+          await nextTick();
+
+          expect(CrawlerOverviewLogic.actions.createNewTimeoutForCrawlRequests).toHaveBeenCalled();
+        });
+      });
+    });
+  });
+
+  describe('selectors', () => {
+    describe('mostRecentCrawlRequestStatus', () => {
+      it('is Success when there are no crawl requests', () => {
+        mount({
+          crawlRequests: [],
+        });
+
+        expect(CrawlerOverviewLogic.values.mostRecentCrawlRequestStatus).toEqual(
+          CrawlerStatus.Success
+        );
+      });
+
+      it('is Success when there are only crawl requests', () => {
+        mount({
+          crawlRequests: [
+            {
+              id: '2',
+              status: CrawlerStatus.Skipped,
+              createdAt: 'Mon, 31 Aug 2020 17:00:00 +0000',
+              beganAt: null,
+              completedAt: null,
+            },
+            {
+              id: '1',
+              status: CrawlerStatus.Skipped,
+              createdAt: 'Mon, 30 Aug 2020 17:00:00 +0000',
+              beganAt: null,
+              completedAt: null,
+            },
+          ],
+        });
+
+        expect(CrawlerOverviewLogic.values.mostRecentCrawlRequestStatus).toEqual(
+          CrawlerStatus.Success
+        );
+      });
+
+      it('is the first non-skipped crawl request status', () => {
+        mount({
+          crawlRequests: [
+            {
+              id: '3',
+              status: CrawlerStatus.Skipped,
+              createdAt: 'Mon, 31 Aug 2020 17:00:00 +0000',
+              beganAt: null,
+              completedAt: null,
+            },
+            {
+              id: '2',
+              status: CrawlerStatus.Failed,
+              createdAt: 'Mon, 30 Aug 2020 17:00:00 +0000',
+              beganAt: null,
+              completedAt: null,
+            },
+            {
+              id: '1',
+              status: CrawlerStatus.Success,
+              createdAt: 'Mon, 29 Aug 2020 17:00:00 +0000',
+              beganAt: null,
+              completedAt: null,
+            },
+          ],
+        });
+
+        expect(CrawlerOverviewLogic.values.mostRecentCrawlRequestStatus).toEqual(
+          CrawlerStatus.Failed
+        );
+      });
+    });
+  });
+
+  describe('events', () => {
+    describe('beforeUnmount', () => {
+      it('clears the timeout if there is one', () => {
+        jest.spyOn(global, 'setTimeout');
+
+        mount({
+          timeoutId: setTimeout(() => {}, 1),
+        });
+        unmount();
+
+        expect(setTimeout).toHaveBeenCalled();
+      });
+
+      it('does not crash if no timeout exists', () => {
+        mount({ timeoutId: null });
+        unmount();
+      });
+    });
   });
 });
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_overview_logic.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_overview_logic.ts
index 5d6d1db2bd8a37..35dd866c0453ef 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_overview_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_overview_logic.ts
@@ -14,7 +14,13 @@ import { flashAPIErrors, flashSuccessToast } from '../../../shared/flash_message
 import { HttpLogic } from '../../../shared/http';
 import { EngineLogic } from '../engine';
 
-import { CrawlerData, CrawlerDomain, CrawlRequest, CrawlRequestFromServer } from './types';
+import {
+  CrawlerData,
+  CrawlerDomain,
+  CrawlRequest,
+  CrawlRequestFromServer,
+  CrawlerStatus,
+} from './types';
 import { crawlerDataServerToClient, crawlRequestServerToClient } from './utils';
 
 export const DELETE_DOMAIN_MESSAGE = (domainUrl: string) =>
@@ -28,17 +34,28 @@ export const DELETE_DOMAIN_MESSAGE = (domainUrl: string) =>
     }
   );
 
+const POLLING_DURATION = 1000;
+const POLLING_DURATION_ON_FAILURE = 5000;
+
 export interface CrawlerOverviewValues {
   crawlRequests: CrawlRequest[];
   dataLoading: boolean;
   domains: CrawlerDomain[];
+  mostRecentCrawlRequestStatus: CrawlerStatus;
+  timeoutId: NodeJS.Timeout | null;
 }
 
 interface CrawlerOverviewActions {
+  clearTimeoutId(): void;
+  createNewTimeoutForCrawlRequests(duration: number): { duration: number };
   deleteDomain(domain: CrawlerDomain): { domain: CrawlerDomain };
   fetchCrawlerData(): void;
+  getLatestCrawlRequests(refreshData?: boolean): { refreshData?: boolean };
+  onCreateNewTimeout(timeoutId: NodeJS.Timeout): { timeoutId: NodeJS.Timeout };
   onReceiveCrawlerData(data: CrawlerData): { data: CrawlerData };
   onReceiveCrawlRequests(crawlRequests: CrawlRequest[]): { crawlRequests: CrawlRequest[] };
+  startCrawl(): void;
+  stopCrawl(): void;
 }
 
 export const CrawlerOverviewLogic = kea<
@@ -46,10 +63,16 @@ export const CrawlerOverviewLogic = kea<
 >({
   path: ['enterprise_search', 'app_search', 'crawler', 'crawler_overview'],
   actions: {
+    clearTimeoutId: true,
+    createNewTimeoutForCrawlRequests: (duration) => ({ duration }),
     deleteDomain: (domain) => ({ domain }),
     fetchCrawlerData: true,
+    getLatestCrawlRequests: (refreshData) => ({ refreshData }),
+    onCreateNewTimeout: (timeoutId) => ({ timeoutId }),
     onReceiveCrawlerData: (data) => ({ data }),
     onReceiveCrawlRequests: (crawlRequests) => ({ crawlRequests }),
+    startCrawl: () => null,
+    stopCrawl: () => null,
   },
   reducers: {
     dataLoading: [
@@ -70,24 +93,33 @@ export const CrawlerOverviewLogic = kea<
         onReceiveCrawlRequests: (_, { crawlRequests }) => crawlRequests,
       },
     ],
+    timeoutId: [
+      null,
+      {
+        clearTimeoutId: () => null,
+        onCreateNewTimeout: (_, { timeoutId }) => timeoutId,
+      },
+    ],
   },
-  listeners: ({ actions }) => ({
+  selectors: ({ selectors }) => ({
+    mostRecentCrawlRequestStatus: [
+      () => [selectors.crawlRequests],
+      (crawlRequests: CrawlerOverviewValues['crawlRequests']) => {
+        const eligibleCrawlRequests = crawlRequests.filter(
+          (req) => req.status !== CrawlerStatus.Skipped
+        );
+        if (eligibleCrawlRequests.length === 0) {
+          return CrawlerStatus.Success;
+        }
+        return eligibleCrawlRequests[0].status;
+      },
+    ],
+  }),
+  listeners: ({ actions, values }) => ({
     fetchCrawlerData: async () => {
       const { http } = HttpLogic.values;
       const { engineName } = EngineLogic.values;
 
-      // TODO Remove fetching crawl requests here once Crawl Request Polling is implemented
-      try {
-        const crawlResultsResponse: CrawlRequestFromServer[] = await http.get(
-          `/api/app_search/engines/${engineName}/crawler/crawl_requests`
-        );
-
-        const crawlRequests = crawlResultsResponse.map(crawlRequestServerToClient);
-        actions.onReceiveCrawlRequests(crawlRequests);
-      } catch (e) {
-        flashAPIErrors(e);
-      }
-
       try {
         const response = await http.get(`/api/app_search/engines/${engineName}/crawler`);
 
@@ -118,5 +150,78 @@ export const CrawlerOverviewLogic = kea<
         flashAPIErrors(e);
       }
     },
+    startCrawl: async () => {
+      const { http } = HttpLogic.values;
+      const { engineName } = EngineLogic.values;
+
+      try {
+        await http.post(`/api/app_search/engines/${engineName}/crawler/crawl_requests`);
+        actions.getLatestCrawlRequests();
+      } catch (e) {
+        flashAPIErrors(e);
+      }
+    },
+    stopCrawl: async () => {
+      const { http } = HttpLogic.values;
+      const { engineName } = EngineLogic.values;
+
+      try {
+        await http.post(`/api/app_search/engines/${engineName}/crawler/crawl_requests/cancel`);
+        actions.getLatestCrawlRequests();
+      } catch (e) {
+        flashAPIErrors(e);
+      }
+    },
+    createNewTimeoutForCrawlRequests: ({ duration }) => {
+      if (values.timeoutId) {
+        clearTimeout(values.timeoutId);
+      }
+
+      const timeoutIdId = setTimeout(() => {
+        actions.getLatestCrawlRequests();
+      }, duration);
+
+      actions.onCreateNewTimeout(timeoutIdId);
+    },
+    getLatestCrawlRequests: async ({ refreshData = true }) => {
+      const { http } = HttpLogic.values;
+      const { engineName } = EngineLogic.values;
+
+      try {
+        const crawlRequestsFromServer: CrawlRequestFromServer[] = await http.get(
+          `/api/app_search/engines/${engineName}/crawler/crawl_requests`
+        );
+        const crawlRequests = crawlRequestsFromServer.map(crawlRequestServerToClient);
+        actions.onReceiveCrawlRequests(crawlRequests);
+        if (
+          [
+            CrawlerStatus.Pending,
+            CrawlerStatus.Starting,
+            CrawlerStatus.Running,
+            CrawlerStatus.Canceling,
+          ].includes(crawlRequests[0]?.status)
+        ) {
+          actions.createNewTimeoutForCrawlRequests(POLLING_DURATION);
+        } else if (
+          [CrawlerStatus.Success, CrawlerStatus.Failed, CrawlerStatus.Canceled].includes(
+            crawlRequests[0]?.status
+          )
+        ) {
+          actions.clearTimeoutId();
+          if (refreshData) {
+            actions.fetchCrawlerData();
+          }
+        }
+      } catch (e) {
+        actions.createNewTimeoutForCrawlRequests(POLLING_DURATION_ON_FAILURE);
+      }
+    },
+  }),
+  events: ({ values }) => ({
+    beforeUnmount: () => {
+      if (values.timeoutId) {
+        clearTimeout(values.timeoutId);
+      }
+    },
   }),
 });
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_router.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_router.test.tsx
index 587ba61ce27e91..3fa01538613195 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_router.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_router.test.tsx
@@ -8,17 +8,22 @@
 import React from 'react';
 import { Switch } from 'react-router-dom';
 
-import { shallow } from 'enzyme';
+import { shallow, ShallowWrapper } from 'enzyme';
+
+import { rerender } from '../../../test_helpers';
 
 import { CrawlerLanding } from './crawler_landing';
 import { CrawlerOverview } from './crawler_overview';
 import { CrawlerRouter } from './crawler_router';
+import { CrawlerSingleDomain } from './crawler_single_domain';
 
 describe('CrawlerRouter', () => {
+  let wrapper: ShallowWrapper;
   const OLD_ENV = process.env;
 
   beforeEach(() => {
     jest.clearAllMocks();
+    wrapper = shallow(<CrawlerRouter />);
   });
 
   afterEach(() => {
@@ -26,16 +31,18 @@ describe('CrawlerRouter', () => {
   });
 
   it('renders a landing page by default', () => {
-    const wrapper = shallow(<CrawlerRouter />);
-
     expect(wrapper.find(Switch)).toHaveLength(1);
     expect(wrapper.find(CrawlerLanding)).toHaveLength(1);
   });
 
   it('renders a crawler overview in dev', () => {
     process.env.NODE_ENV = 'development';
-    const wrapper = shallow(<CrawlerRouter />);
+    rerender(wrapper);
 
     expect(wrapper.find(CrawlerOverview)).toHaveLength(1);
   });
+
+  it('renders a crawler single domain view', () => {
+    expect(wrapper.find(CrawlerSingleDomain)).toHaveLength(1);
+  });
 });
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_router.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_router.tsx
index c5dd3907c9019e..3919740b0c6cb0 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_router.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_router.tsx
@@ -8,10 +8,11 @@
 import React from 'react';
 import { Route, Switch } from 'react-router-dom';
 
-import { ENGINE_CRAWLER_PATH } from '../../routes';
+import { ENGINE_CRAWLER_DOMAIN_PATH, ENGINE_CRAWLER_PATH } from '../../routes';
 
 import { CrawlerLanding } from './crawler_landing';
 import { CrawlerOverview } from './crawler_overview';
+import { CrawlerSingleDomain } from './crawler_single_domain';
 
 export const CrawlerRouter: React.FC = () => {
   return (
@@ -19,6 +20,9 @@ export const CrawlerRouter: React.FC = () => {
       <Route exact path={ENGINE_CRAWLER_PATH}>
         {process.env.NODE_ENV === 'development' ? <CrawlerOverview /> : <CrawlerLanding />}
       </Route>
+      <Route exact path={ENGINE_CRAWLER_DOMAIN_PATH}>
+        <CrawlerSingleDomain />
+      </Route>
     </Switch>
   );
 };
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_single_domain.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_single_domain.test.tsx
new file mode 100644
index 00000000000000..e2b230041c8109
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_single_domain.test.tsx
@@ -0,0 +1,79 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { setMockActions, setMockValues } from '../../../__mocks__/kea_logic';
+import '../../../__mocks__/shallow_useeffect.mock';
+import '../../__mocks__/engine_logic.mock';
+import { mockUseParams } from '../../../__mocks__/react_router';
+
+import React from 'react';
+
+import { shallow } from 'enzyme';
+
+import { EuiCode } from '@elastic/eui';
+
+import { getPageHeaderActions } from '../../../test_helpers';
+
+import { CrawlerStatusBanner } from './components/crawler_status_banner';
+import { CrawlerStatusIndicator } from './components/crawler_status_indicator/crawler_status_indicator';
+import { CrawlerOverview } from './crawler_overview';
+import { CrawlerSingleDomain } from './crawler_single_domain';
+
+const MOCK_VALUES = {
+  // CrawlerSingleDomainLogic
+  dataLoading: false,
+  domain: {
+    url: 'https://elastic.co',
+  },
+  // CrawlerOverviewLogic
+  domains: [],
+  crawlRequests: [],
+};
+
+const MOCK_ACTIONS = {
+  fetchCrawlerData: jest.fn(),
+  fetchDomainData: jest.fn(),
+  getLatestCrawlRequests: jest.fn(),
+};
+
+describe('CrawlerSingleDomain', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockUseParams.mockReturnValue({ domainId: '507f1f77bcf86cd799439011' });
+    setMockActions(MOCK_ACTIONS);
+    setMockValues(MOCK_VALUES);
+  });
+
+  it('renders', () => {
+    const wrapper = shallow(<CrawlerSingleDomain />);
+
+    expect(wrapper.find(EuiCode).render().text()).toContain('https://elastic.co');
+    expect(wrapper.prop('pageHeader').pageTitle).toEqual('https://elastic.co');
+  });
+
+  it('uses a placeholder for the page title and page chrome if a domain has not been set', () => {
+    setMockValues({
+      ...MOCK_VALUES,
+      domain: null,
+    });
+
+    const wrapper = shallow(<CrawlerSingleDomain />);
+
+    expect(wrapper.prop('pageHeader').pageTitle).toEqual('Loading...');
+  });
+
+  it('contains a crawler status banner', () => {
+    const wrapper = shallow(<CrawlerOverview />);
+
+    expect(wrapper.find(CrawlerStatusBanner)).toHaveLength(1);
+  });
+
+  it('contains a crawler status indicator', () => {
+    const wrapper = shallow(<CrawlerOverview />);
+
+    expect(getPageHeaderActions(wrapper).find(CrawlerStatusIndicator)).toHaveLength(1);
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_single_domain.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_single_domain.tsx
new file mode 100644
index 00000000000000..9f9ec288a690c8
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_single_domain.tsx
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useEffect } from 'react';
+
+import { useParams } from 'react-router-dom';
+
+import { useActions, useValues } from 'kea';
+
+import { EuiCode, EuiSpacer } from '@elastic/eui';
+
+import { i18n } from '@kbn/i18n';
+
+import { getEngineBreadcrumbs } from '../engine';
+import { AppSearchPageTemplate } from '../layout';
+
+import { CrawlerStatusBanner } from './components/crawler_status_banner';
+import { CrawlerStatusIndicator } from './components/crawler_status_indicator/crawler_status_indicator';
+import { CRAWLER_TITLE } from './constants';
+import { CrawlerSingleDomainLogic } from './crawler_single_domain_logic';
+
+export const CrawlerSingleDomain: React.FC = () => {
+  const { domainId } = useParams() as { domainId: string };
+
+  const { dataLoading, domain } = useValues(CrawlerSingleDomainLogic);
+
+  const { fetchDomainData } = useActions(CrawlerSingleDomainLogic);
+
+  const displayDomainUrl = domain
+    ? domain.url
+    : i18n.translate('xpack.enterpriseSearch.appSearch.crawler.singleDomain.loadingTitle', {
+        defaultMessage: 'Loading...',
+      });
+
+  useEffect(() => {
+    fetchDomainData(domainId);
+  }, []);
+
+  return (
+    <AppSearchPageTemplate
+      pageChrome={getEngineBreadcrumbs([CRAWLER_TITLE, displayDomainUrl])}
+      pageHeader={{ pageTitle: displayDomainUrl, rightSideItems: [<CrawlerStatusIndicator />] }}
+      isLoading={dataLoading}
+    >
+      <CrawlerStatusBanner />
+      <EuiSpacer size="l" />
+      <EuiCode>{JSON.stringify(domain, null, 2)}</EuiCode>
+    </AppSearchPageTemplate>
+  );
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_single_domain_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_single_domain_logic.test.ts
new file mode 100644
index 00000000000000..bb478a30ee5ef2
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_single_domain_logic.test.ts
@@ -0,0 +1,98 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  LogicMounter,
+  mockHttpValues,
+  mockFlashMessageHelpers,
+} from '../../../__mocks__/kea_logic';
+import '../../__mocks__/engine_logic.mock';
+
+import { nextTick } from '@kbn/test/jest';
+
+import { CrawlerSingleDomainLogic, CrawlerSingleDomainValues } from './crawler_single_domain_logic';
+import { CrawlerDomain } from './types';
+
+const DEFAULT_VALUES: CrawlerSingleDomainValues = {
+  dataLoading: true,
+  domain: null,
+};
+
+describe('CrawlerSingleDomainLogic', () => {
+  const { mount } = new LogicMounter(CrawlerSingleDomainLogic);
+  const { http } = mockHttpValues;
+  const { flashAPIErrors } = mockFlashMessageHelpers;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mount();
+  });
+
+  it('has expected default values', () => {
+    expect(CrawlerSingleDomainLogic.values).toEqual(DEFAULT_VALUES);
+  });
+
+  describe('actions', () => {
+    describe('onReceiveDomainData', () => {
+      const domain = {
+        id: '507f1f77bcf86cd799439011',
+      };
+
+      beforeEach(() => {
+        CrawlerSingleDomainLogic.actions.onReceiveDomainData(domain as CrawlerDomain);
+      });
+
+      it('should set the domain', () => {
+        expect(CrawlerSingleDomainLogic.values.domain).toEqual(domain);
+      });
+    });
+  });
+
+  describe('listeners', () => {
+    describe('fetchDomainData', () => {
+      it('updates logic with data that has been converted from server to client', async () => {
+        jest.spyOn(CrawlerSingleDomainLogic.actions, 'onReceiveDomainData');
+        http.get.mockReturnValueOnce(
+          Promise.resolve({
+            id: '507f1f77bcf86cd799439011',
+            name: 'https://elastic.co',
+            created_on: 'Mon, 31 Aug 2020 17:00:00 +0000',
+            document_count: 13,
+            sitemaps: [],
+            entry_points: [],
+            crawl_rules: [],
+          })
+        );
+
+        CrawlerSingleDomainLogic.actions.fetchDomainData('507f1f77bcf86cd799439011');
+        await nextTick();
+
+        expect(http.get).toHaveBeenCalledWith(
+          '/api/app_search/engines/some-engine/crawler/domains/507f1f77bcf86cd799439011'
+        );
+        expect(CrawlerSingleDomainLogic.actions.onReceiveDomainData).toHaveBeenCalledWith({
+          id: '507f1f77bcf86cd799439011',
+          createdOn: 'Mon, 31 Aug 2020 17:00:00 +0000',
+          url: 'https://elastic.co',
+          documentCount: 13,
+          sitemaps: [],
+          entryPoints: [],
+          crawlRules: [],
+        });
+      });
+
+      it('displays any errors to the user', async () => {
+        http.get.mockReturnValueOnce(Promise.reject('error'));
+
+        CrawlerSingleDomainLogic.actions.fetchDomainData('507f1f77bcf86cd799439011');
+        await nextTick();
+
+        expect(flashAPIErrors).toHaveBeenCalledWith('error');
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_single_domain_logic.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_single_domain_logic.ts
new file mode 100644
index 00000000000000..bccd67a4921d15
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/crawler/crawler_single_domain_logic.ts
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { kea, MakeLogicType } from 'kea';
+
+import { flashAPIErrors } from '../../../shared/flash_messages';
+
+import { HttpLogic } from '../../../shared/http';
+import { EngineLogic } from '../engine';
+
+import { CrawlerDomain } from './types';
+import { crawlerDomainServerToClient } from './utils';
+
+export interface CrawlerSingleDomainValues {
+  dataLoading: boolean;
+  domain: CrawlerDomain | null;
+}
+
+interface CrawlerSingleDomainActions {
+  fetchDomainData(domainId: string): { domainId: string };
+  onReceiveDomainData(domain: CrawlerDomain): { domain: CrawlerDomain };
+}
+
+export const CrawlerSingleDomainLogic = kea<
+  MakeLogicType<CrawlerSingleDomainValues, CrawlerSingleDomainActions>
+>({
+  path: ['enterprise_search', 'app_search', 'crawler', 'crawler_single_domain'],
+  actions: {
+    fetchDomainData: (domainId) => ({ domainId }),
+    onReceiveDomainData: (domain) => ({ domain }),
+  },
+  reducers: {
+    dataLoading: [
+      true,
+      {
+        onReceiveDomainData: () => false,
+      },
+    ],
+    domain: [
+      null,
+      {
+        onReceiveDomainData: (_, { domain }) => domain,
+      },
+    ],
+  },
+  listeners: ({ actions }) => ({
+    fetchDomainData: async ({ domainId }) => {
+      const { http } = HttpLogic.values;
+      const { engineName } = EngineLogic.values;
+
+      try {
+        const response = await http.get(
+          `/api/app_search/engines/${engineName}/crawler/domains/${domainId}`
+        );
+
+        const domainData = crawlerDomainServerToClient(response);
+
+        actions.onReceiveDomainData(domainData);
+      } catch (e) {
+        flashAPIErrors(e);
+      }
+    },
+  }),
+});
diff --git a/x-pack/plugins/enterprise_search/server/routes/app_search/crawler.test.ts b/x-pack/plugins/enterprise_search/server/routes/app_search/crawler.test.ts
index f54771e2bef9a7..3b790bf2696cb9 100644
--- a/x-pack/plugins/enterprise_search/server/routes/app_search/crawler.test.ts
+++ b/x-pack/plugins/enterprise_search/server/routes/app_search/crawler.test.ts
@@ -76,6 +76,72 @@ describe('crawler routes', () => {
     });
   });
 
+  describe('POST /api/app_search/engines/{name}/crawler/crawl_requests', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockRouter = new MockRouter({
+        method: 'post',
+        path: '/api/app_search/engines/{name}/crawler/crawl_requests',
+      });
+
+      registerCrawlerRoutes({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+    });
+
+    it('creates a request to enterprise search', () => {
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/api/as/v0/engines/:name/crawler/crawl_requests',
+      });
+    });
+
+    it('validates correctly with name', () => {
+      const request = { params: { name: 'some-engine' } };
+      mockRouter.shouldValidate(request);
+    });
+
+    it('fails validation without name', () => {
+      const request = { params: {} };
+      mockRouter.shouldThrow(request);
+    });
+  });
+
+  describe('POST /api/app_search/engines/{name}/crawler/crawl_requests/cancel', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockRouter = new MockRouter({
+        method: 'post',
+        path: '/api/app_search/engines/{name}/crawler/crawl_requests/cancel',
+      });
+
+      registerCrawlerRoutes({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+    });
+
+    it('creates a request to enterprise search', () => {
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/api/as/v0/engines/:name/crawler/crawl_requests/active/cancel',
+      });
+    });
+
+    it('validates correctly with name', () => {
+      const request = { params: { name: 'some-engine' } };
+      mockRouter.shouldValidate(request);
+    });
+
+    it('fails validation without name', () => {
+      const request = { params: {} };
+      mockRouter.shouldThrow(request);
+    });
+  });
+
   describe('POST /api/app_search/engines/{name}/crawler/domains', () => {
     let mockRouter: MockRouter;
 
@@ -178,6 +244,44 @@ describe('crawler routes', () => {
     });
   });
 
+  describe('GET /api/app_search/engines/{name}/crawler/domains/{id}', () => {
+    let mockRouter: MockRouter;
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockRouter = new MockRouter({
+        method: 'get',
+        path: '/api/app_search/engines/{name}/crawler/domains/{id}',
+      });
+
+      registerCrawlerRoutes({
+        ...mockDependencies,
+        router: mockRouter.router,
+      });
+    });
+
+    it('creates a request to enterprise search', () => {
+      expect(mockRequestHandler.createRequest).toHaveBeenCalledWith({
+        path: '/api/as/v0/engines/:name/crawler/domains/:id',
+      });
+    });
+
+    it('validates correctly with name and id', () => {
+      const request = { params: { name: 'some-engine', id: '1234' } };
+      mockRouter.shouldValidate(request);
+    });
+
+    it('fails validation without name', () => {
+      const request = { params: { id: '1234' } };
+      mockRouter.shouldThrow(request);
+    });
+
+    it('fails validation without id', () => {
+      const request = { params: { name: 'test-engine' } };
+      mockRouter.shouldThrow(request);
+    });
+  });
+
   describe('POST /api/app_search/crawler/validate_url', () => {
     let mockRouter: MockRouter;
 
diff --git a/x-pack/plugins/enterprise_search/server/routes/app_search/crawler.ts b/x-pack/plugins/enterprise_search/server/routes/app_search/crawler.ts
index 5404a9a00bdac1..26a755a6d2b6c9 100644
--- a/x-pack/plugins/enterprise_search/server/routes/app_search/crawler.ts
+++ b/x-pack/plugins/enterprise_search/server/routes/app_search/crawler.ts
@@ -41,6 +41,34 @@ export function registerCrawlerRoutes({
     })
   );
 
+  router.post(
+    {
+      path: '/api/app_search/engines/{name}/crawler/crawl_requests',
+      validate: {
+        params: schema.object({
+          name: schema.string(),
+        }),
+      },
+    },
+    enterpriseSearchRequestHandler.createRequest({
+      path: '/api/as/v0/engines/:name/crawler/crawl_requests',
+    })
+  );
+
+  router.post(
+    {
+      path: '/api/app_search/engines/{name}/crawler/crawl_requests/cancel',
+      validate: {
+        params: schema.object({
+          name: schema.string(),
+        }),
+      },
+    },
+    enterpriseSearchRequestHandler.createRequest({
+      path: '/api/as/v0/engines/:name/crawler/crawl_requests/active/cancel',
+    })
+  );
+
   router.post(
     {
       path: '/api/app_search/engines/{name}/crawler/domains',
@@ -66,6 +94,21 @@ export function registerCrawlerRoutes({
     })
   );
 
+  router.get(
+    {
+      path: '/api/app_search/engines/{name}/crawler/domains/{id}',
+      validate: {
+        params: schema.object({
+          name: schema.string(),
+          id: schema.string(),
+        }),
+      },
+    },
+    enterpriseSearchRequestHandler.createRequest({
+      path: '/api/as/v0/engines/:name/crawler/domains/:id',
+    })
+  );
+
   router.delete(
     {
       path: '/api/app_search/engines/{name}/crawler/domains/{id}',
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/components/package_policy_input_var_field.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/components/package_policy_input_var_field.tsx
index eed94de97113d1..398421278b7232 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/components/package_policy_input_var_field.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/components/package_policy_input_var_field.tsx
@@ -7,21 +7,20 @@
 
 import React, { useState, memo, useMemo } from 'react';
 import ReactMarkdown from 'react-markdown';
+import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import {
   EuiFormRow,
   EuiSwitch,
   EuiFieldText,
   EuiText,
-  EuiCodeEditor,
-  EuiTextArea,
   EuiFieldPassword,
+  EuiCodeBlock,
 } from '@elastic/eui';
 
 import type { RegistryVarsEntry } from '../../../../types';
+import { CodeEditor } from '../../../../../../../../../../src/plugins/kibana_react/public';
 
-import 'brace/mode/yaml';
-import 'brace/theme/textmate';
 import { MultiTextInput } from './multi_text_input';
 
 export const PackagePolicyInputVarField: React.FunctionComponent<{
@@ -52,26 +51,34 @@ export const PackagePolicyInputVarField: React.FunctionComponent<{
     switch (type) {
       case 'yaml':
         return frozen ? (
-          <EuiTextArea
-            className="ace_editor"
-            disabled
-            value={value}
-            style={{ height: '175px', padding: '4px', whiteSpace: 'pre', resize: 'none' }}
-          />
+          <EuiCodeBlock language="yaml" isCopyable={false} paddingSize="s">
+            <pre>{value}</pre>
+          </EuiCodeBlock>
         ) : (
-          <EuiCodeEditor
+          <CodeEditor
+            languageId="yaml"
             width="100%"
-            mode="yaml"
-            theme="textmate"
-            setOptions={{
-              minLines: 10,
-              maxLines: 30,
+            height="300px"
+            value={value}
+            onChange={onChange}
+            options={{
+              minimap: {
+                enabled: false,
+              },
+              ariaLabel: i18n.translate('xpack.fleet.packagePolicyField.yamlCodeEditor', {
+                defaultMessage: 'YAML Code Editor',
+              }),
+              scrollBeyondLastLine: false,
+              wordWrap: 'off',
+              wrappingIndent: 'indent',
               tabSize: 2,
-              showGutter: false,
+              // To avoid left margin
+              lineNumbers: 'off',
+              lineNumbersMinChars: 0,
+              glyphMargin: false,
+              folding: false,
+              lineDecorationsWidth: 0,
             }}
-            value={value}
-            onChange={(newVal) => onChange(newVal)}
-            onBlur={() => setIsDirty(true)}
           />
         );
       case 'bool':
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx
index fbd6e07e07bbdb..74572e74dd5082 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/index.tsx
@@ -141,7 +141,6 @@ const AvailablePackages: React.FC = memo(() => {
   const queryParams = new URLSearchParams(useLocation().search);
   const initialCategory = queryParams.get('category') || '';
   const [selectedCategory, setSelectedCategory] = useState(initialCategory);
-  const { data: allPackagesRes, isLoading: isLoadingAllPackages } = useGetPackages();
   const { data: categoryPackagesRes, isLoading: isLoadingCategoryPackages } = useGetPackages({
     category: selectedCategory,
   });
@@ -168,16 +167,16 @@ const AvailablePackages: React.FC = memo(() => {
         title: i18n.translate('xpack.fleet.epmList.allPackagesFilterLinkText', {
           defaultMessage: 'All',
         }),
-        count: allPackagesRes?.response?.length || 0,
+        count: packages?.length || 0,
       },
       ...(categoriesRes ? categoriesRes.response : []),
     ],
-    [allPackagesRes?.response?.length, categoriesRes]
+    [packages?.length, categoriesRes]
   );
 
   const controls = categories ? (
     <CategoryFacets
-      isLoading={isLoadingCategories || isLoadingAllPackages}
+      isLoading={isLoadingCategories}
       categories={categories}
       selectedCategory={selectedCategory}
       onCategoryChange={({ id }: CategorySummaryItem) => {
diff --git a/x-pack/plugins/fleet/public/components/settings_flyout/index.tsx b/x-pack/plugins/fleet/public/components/settings_flyout/index.tsx
index 9bc1bc977b7861..3d3a4dda606320 100644
--- a/x-pack/plugins/fleet/public/components/settings_flyout/index.tsx
+++ b/x-pack/plugins/fleet/public/components/settings_flyout/index.tsx
@@ -6,6 +6,7 @@
  */
 
 import React, { useEffect, useCallback } from 'react';
+import styled from 'styled-components';
 import { i18n } from '@kbn/i18n';
 import {
   EuiFlyout,
@@ -21,9 +22,9 @@ import {
   EuiForm,
   EuiFormRow,
   EuiCode,
-  EuiCodeEditor,
   EuiLink,
   EuiPanel,
+  EuiTextColor,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiText } from '@elastic/eui';
@@ -39,13 +40,29 @@ import {
   sendPutOutput,
 } from '../../hooks';
 import { isDiffPathProtocol, normalizeHostsForAgents } from '../../../common';
+import { CodeEditor } from '../../../../../../src/plugins/kibana_react/public';
 
 import { SettingsConfirmModal } from './confirm_modal';
 import type { SettingsConfirmModalProps } from './confirm_modal';
 import { HostsInput } from './hosts_input';
 
-import 'brace/mode/yaml';
-import 'brace/theme/textmate';
+const CodeEditorContainer = styled.div`
+  min-height: 0;
+  position: relative;
+  height: 250px;
+`;
+
+const CodeEditorPlaceholder = styled(EuiTextColor).attrs((props) => ({
+  color: 'subdued',
+  size: 'xs',
+}))`
+  position: absolute;
+  top: 0;
+  right: 0;
+  // Matches monaco editor
+  font-family: Menlo, Monaco, 'Courier New', monospace;
+  pointer-events: none;
+`;
 
 const URL_REGEX = /^(https?):\/\/[^\s$.?#].[^\s]*$/gm;
 
@@ -361,21 +378,40 @@ export const SettingFlyout: React.FunctionComponent<Props> = ({ onClose }) => {
           })}
           fullWidth
         >
-          <EuiCodeEditor
-            width="100%"
-            mode="yaml"
-            theme="textmate"
-            placeholder="# YAML settings here will be added to the Elasticsearch output section of each policy"
-            setOptions={{
-              minLines: 10,
-              maxLines: 30,
-              tabSize: 2,
-              showGutter: false,
-              showPrintMargin: false,
-            }}
-            {...inputs.additionalYamlConfig.props}
-            onChange={inputs.additionalYamlConfig.setValue}
-          />
+          <CodeEditorContainer>
+            <CodeEditor
+              languageId="yaml"
+              width="100%"
+              height="250px"
+              value={inputs.additionalYamlConfig.value}
+              onChange={inputs.additionalYamlConfig.setValue}
+              options={{
+                minimap: {
+                  enabled: false,
+                },
+
+                ariaLabel: i18n.translate('xpack.fleet.settings.yamlCodeEditor', {
+                  defaultMessage: 'YAML Code Editor',
+                }),
+                scrollBeyondLastLine: false,
+                wordWrap: 'on',
+                wrappingIndent: 'indent',
+                automaticLayout: true,
+                tabSize: 2,
+                // To avoid left margin
+                lineNumbers: 'off',
+                lineNumbersMinChars: 0,
+                glyphMargin: false,
+                folding: false,
+                lineDecorationsWidth: 0,
+              }}
+            />
+            {(!inputs.additionalYamlConfig.value || inputs.additionalYamlConfig.value === '') && (
+              <CodeEditorPlaceholder>
+                {`# YAML settings here will be added to the Elasticsearch output section of each policy`}
+              </CodeEditorPlaceholder>
+            )}
+          </CodeEditorContainer>
         </EuiFormRow>
       </EuiPanel>
     </EuiForm>
diff --git a/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_15_0.test.ts b/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_15_0.test.ts
index e4317bcb260e19..6064bcaf99e372 100644
--- a/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_15_0.test.ts
+++ b/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_15_0.test.ts
@@ -18,6 +18,12 @@ describe('7.15.0 Endpoint Package Policy migration', () => {
     windowsPopup = {},
     windowsMalware = {},
     windowsRansomware = {},
+    macBehavior = {},
+    macMalware = {},
+    macPopup = {},
+    linuxBehavior = {},
+    linuxMalware = {},
+    linuxPopup = {},
   }) => {
     return {
       id: 'mock-saved-object-id',
@@ -53,6 +59,16 @@ describe('7.15.0 Endpoint Package Policy migration', () => {
                     ...windowsBehavior,
                     ...windowsPopup,
                   },
+                  mac: {
+                    ...macMalware,
+                    ...macBehavior,
+                    ...macPopup,
+                  },
+                  linux: {
+                    ...linuxMalware,
+                    ...linuxBehavior,
+                    ...linuxPopup,
+                  },
                 },
               },
             },
@@ -63,7 +79,7 @@ describe('7.15.0 Endpoint Package Policy migration', () => {
     };
   };
 
-  it('adds windows memory and behavior protection alongside malware and ramsomware', () => {
+  it('adds windows memory protection, and windows, mac and linux behavior protection alongside malware and ramsomware', () => {
     const initialDoc = policyDoc({
       windowsMalware: { malware: { mode: 'off' } },
       windowsRansomware: { ransomware: { mode: 'off', supported: true } },
@@ -79,6 +95,24 @@ describe('7.15.0 Endpoint Package Policy migration', () => {
           },
         },
       },
+      macMalware: { malware: { mode: 'off' } },
+      macPopup: {
+        popup: {
+          malware: {
+            message: '',
+            enabled: true,
+          },
+        },
+      },
+      linuxMalware: { malware: { mode: 'off' } },
+      linuxPopup: {
+        popup: {
+          malware: {
+            message: '',
+            enabled: true,
+          },
+        },
+      },
     });
 
     const migratedDoc = policyDoc({
@@ -109,6 +143,36 @@ describe('7.15.0 Endpoint Package Policy migration', () => {
           },
         },
       },
+      macMalware: { malware: { mode: 'off' } },
+      macBehavior: { behavior_protection: { mode: 'off', supported: true } },
+      macPopup: {
+        popup: {
+          malware: {
+            message: '',
+            enabled: true,
+          },
+          // new behavior popup setup
+          behavior_protection: {
+            message: '',
+            enabled: false,
+          },
+        },
+      },
+      linuxMalware: { malware: { mode: 'off' } },
+      linuxBehavior: { behavior_protection: { mode: 'off', supported: true } },
+      linuxPopup: {
+        popup: {
+          malware: {
+            message: '',
+            enabled: true,
+          },
+          // new behavior popup setup
+          behavior_protection: {
+            message: '',
+            enabled: false,
+          },
+        },
+      },
     });
 
     expect(migration(initialDoc, {} as SavedObjectMigrationContext)).toEqual(migratedDoc);
diff --git a/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_15_0.ts b/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_15_0.ts
index 071ab327920ce2..9ccafc58989f3b 100644
--- a/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_15_0.ts
+++ b/x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_15_0.ts
@@ -49,6 +49,10 @@ export const migratePackagePolicyToV7150: SavedObjectMigrationFn<PackagePolicy,
     policy.windows.popup.memory_protection = memoryPopup;
     policy.windows.behavior_protection = behavior;
     policy.windows.popup.behavior_protection = behaviorPopup;
+    policy.mac.behavior_protection = behavior;
+    policy.mac.popup.behavior_protection = behaviorPopup;
+    policy.linux.behavior_protection = behavior;
+    policy.linux.popup.behavior_protection = behaviorPopup;
   }
 
   return updatedPackagePolicyDoc;
diff --git a/x-pack/plugins/fleet/server/services/preconfiguration.test.ts b/x-pack/plugins/fleet/server/services/preconfiguration.test.ts
index 5ea4b896e7fa1b..d374553e1db83b 100644
--- a/x-pack/plugins/fleet/server/services/preconfiguration.test.ts
+++ b/x-pack/plugins/fleet/server/services/preconfiguration.test.ts
@@ -14,6 +14,8 @@ import type { AgentPolicy, NewPackagePolicy, Output } from '../types';
 
 import { AGENT_POLICY_SAVED_OBJECT_TYPE } from '../constants';
 
+import * as agentPolicy from './agent_policy';
+
 import {
   ensurePreconfiguredPackagesAndPolicies,
   comparePreconfiguredPolicyToCurrent,
@@ -128,6 +130,7 @@ jest.mock('./epm/packages/get', () => ({
 jest.mock('./package_policy', () => ({
   ...jest.requireActual('./package_policy'),
   packagePolicyService: {
+    getByIDs: jest.fn().mockReturnValue([]),
     create(soClient: any, esClient: any, newPackagePolicy: NewPackagePolicy) {
       return {
         id: 'mocked',
@@ -152,10 +155,13 @@ jest.mock('./app_context', () => ({
   },
 }));
 
+const spyAgentPolicyServiceUpdate = jest.spyOn(agentPolicy.agentPolicyService, 'update');
+
 describe('policy preconfiguration', () => {
   beforeEach(() => {
     mockInstalledPackages.clear();
     mockConfiguredPolicies.clear();
+    spyAgentPolicyServiceUpdate.mockClear();
   });
 
   it('should perform a no-op when passed no policies or packages', async () => {
@@ -331,6 +337,84 @@ describe('policy preconfiguration', () => {
     expect(policiesB[0].updated_at).toEqual(policiesA[0].updated_at);
     expect(nonFatalErrorsB.length).toBe(0);
   });
+
+  it('should update a managed policy if top level fields are changed', async () => {
+    const soClient = getPutPreconfiguredPackagesMock();
+    const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+
+    mockConfiguredPolicies.set('test-id', {
+      name: 'Test policy',
+      description: 'Test policy description',
+      unenroll_timeout: 120,
+      namespace: 'default',
+      id: 'test-id',
+      package_policies: [],
+      is_managed: true,
+    } as PreconfiguredAgentPolicy);
+
+    const {
+      policies,
+      nonFatalErrors: nonFatalErrorsB,
+    } = await ensurePreconfiguredPackagesAndPolicies(
+      soClient,
+      esClient,
+      [
+        {
+          name: 'Renamed Test policy',
+          description: 'Renamed Test policy description',
+          unenroll_timeout: 999,
+          namespace: 'default',
+          id: 'test-id',
+          is_managed: true,
+          package_policies: [],
+        },
+      ] as PreconfiguredAgentPolicy[],
+      [],
+      mockDefaultOutput
+    );
+    expect(spyAgentPolicyServiceUpdate).toBeCalled();
+    expect(spyAgentPolicyServiceUpdate).toBeCalledWith(
+      expect.anything(), // soClient
+      expect.anything(), // esClient
+      'test-id',
+      expect.objectContaining({
+        name: 'Renamed Test policy',
+        description: 'Renamed Test policy description',
+        unenroll_timeout: 999,
+      })
+    );
+    expect(policies.length).toEqual(1);
+    expect(policies[0].id).toBe('test-id');
+    expect(nonFatalErrorsB.length).toBe(0);
+  });
+
+  it('should not update a managed policy if a top level field has not changed', async () => {
+    const soClient = getPutPreconfiguredPackagesMock();
+    const esClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+    const policy: PreconfiguredAgentPolicy = {
+      name: 'Test policy',
+      namespace: 'default',
+      id: 'test-id',
+      package_policies: [],
+      is_managed: true,
+    };
+    mockConfiguredPolicies.set('test-id', policy);
+
+    const {
+      policies,
+      nonFatalErrors: nonFatalErrorsB,
+    } = await ensurePreconfiguredPackagesAndPolicies(
+      soClient,
+      esClient,
+      [policy],
+      [],
+      mockDefaultOutput
+    );
+    expect(spyAgentPolicyServiceUpdate).not.toBeCalled();
+    expect(policies.length).toEqual(1);
+    expect(policies[0].id).toBe('test-id');
+    expect(nonFatalErrorsB.length).toBe(0);
+  });
 });
 
 describe('comparePreconfiguredPolicyToCurrent', () => {
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.tsx.snap b/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.tsx.snap
index 95950093472598..aa978d27f9e230 100644
--- a/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.tsx.snap
+++ b/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.tsx.snap
@@ -326,6 +326,7 @@ exports[`extend index management ilm summary extension should return extension w
           >
             <div
               className="euiTextColor euiTextColor--default"
+              style={Object {}}
             >
               illegal_argument_exception
               : 
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/policy_table.test.tsx.snap b/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/policy_table.test.tsx.snap
index 97d1c1757e85ad..8f375305d359e7 100644
--- a/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/policy_table.test.tsx.snap
+++ b/x-pack/plugins/index_lifecycle_management/__jest__/__snapshots__/policy_table.test.tsx.snap
@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`policy table should change pages when a pagination link is clicked on 1`] = `
+exports[`policy table changes pages when a pagination link is clicked on 1`] = `
 Array [
   "testy0",
   "testy1",
@@ -15,7 +15,7 @@ Array [
 ]
 `;
 
-exports[`policy table should change pages when a pagination link is clicked on 2`] = `
+exports[`policy table changes pages when a pagination link is clicked on 2`] = `
 Array [
   "testy13",
   "testy14",
@@ -30,22 +30,13 @@ Array [
 ]
 `;
 
-exports[`policy table should filter based on content of search input 1`] = `
+exports[`policy table filters based on content of search input 1`] = `
 Array [
   "testy0",
-  "testy1",
-  "testy10",
-  "testy100",
-  "testy101",
-  "testy102",
-  "testy103",
-  "testy104",
-  "testy11",
-  "testy12",
 ]
 `;
 
-exports[`policy table should show empty state when there are not any policies 1`] = `
+exports[`policy table shows empty state when there are no policies 1`] = `
 <div
   class="euiPanel euiPanel--paddingLarge euiPanel--borderRadiusMedium euiPanel--subdued euiPanel--noShadow euiPanel--noBorder euiPageContent euiPageContent--verticalCenter euiPageContent--horizontalCenter"
   role="main"
@@ -106,7 +97,7 @@ exports[`policy table should show empty state when there are not any policies 1`
 </div>
 `;
 
-exports[`policy table should sort when linked index templates header is clicked 1`] = `
+exports[`policy table sorts when linked index templates header is clicked 1`] = `
 Array [
   "testy1",
   "testy3",
@@ -121,22 +112,22 @@ Array [
 ]
 `;
 
-exports[`policy table should sort when linked index templates header is clicked 2`] = `
+exports[`policy table sorts when linked index templates header is clicked 2`] = `
 Array [
   "testy0",
-  "testy104",
-  "testy102",
-  "testy100",
-  "testy98",
-  "testy96",
-  "testy94",
-  "testy92",
-  "testy90",
-  "testy88",
+  "testy2",
+  "testy4",
+  "testy6",
+  "testy8",
+  "testy10",
+  "testy12",
+  "testy14",
+  "testy16",
+  "testy18",
 ]
 `;
 
-exports[`policy table should sort when linked indices header is clicked 1`] = `
+exports[`policy table sorts when linked indices header is clicked 1`] = `
 Array [
   "testy1",
   "testy3",
@@ -151,22 +142,22 @@ Array [
 ]
 `;
 
-exports[`policy table should sort when linked indices header is clicked 2`] = `
+exports[`policy table sorts when linked indices header is clicked 2`] = `
 Array [
-  "testy104",
-  "testy102",
-  "testy100",
-  "testy98",
-  "testy96",
-  "testy94",
-  "testy92",
-  "testy90",
-  "testy88",
-  "testy86",
+  "testy0",
+  "testy2",
+  "testy4",
+  "testy6",
+  "testy8",
+  "testy10",
+  "testy12",
+  "testy14",
+  "testy16",
+  "testy18",
 ]
 `;
 
-exports[`policy table should sort when modified date header is clicked 1`] = `
+exports[`policy table sorts when modified date header is clicked 1`] = `
 Array [
   "testy0",
   "testy104",
@@ -181,7 +172,7 @@ Array [
 ]
 `;
 
-exports[`policy table should sort when modified date header is clicked 2`] = `
+exports[`policy table sorts when modified date header is clicked 2`] = `
 Array [
   "testy1",
   "testy2",
@@ -196,7 +187,7 @@ Array [
 ]
 `;
 
-exports[`policy table should sort when name header is clicked 1`] = `
+exports[`policy table sorts when name header is clicked 1`] = `
 Array [
   "testy99",
   "testy98",
@@ -211,22 +202,7 @@ Array [
 ]
 `;
 
-exports[`policy table should sort when name header is clicked 2`] = `
-Array [
-  "testy0",
-  "testy1",
-  "testy10",
-  "testy100",
-  "testy101",
-  "testy102",
-  "testy103",
-  "testy104",
-  "testy11",
-  "testy12",
-]
-`;
-
-exports[`policy table should sort when version header is clicked 1`] = `
+exports[`policy table sorts when name header is clicked 2`] = `
 Array [
   "testy0",
   "testy1",
@@ -240,18 +216,3 @@ Array [
   "testy9",
 ]
 `;
-
-exports[`policy table should sort when version header is clicked 2`] = `
-Array [
-  "testy104",
-  "testy103",
-  "testy102",
-  "testy101",
-  "testy100",
-  "testy99",
-  "testy98",
-  "testy97",
-  "testy96",
-  "testy95",
-]
-`;
diff --git a/x-pack/plugins/index_lifecycle_management/__jest__/policy_table.test.tsx b/x-pack/plugins/index_lifecycle_management/__jest__/policy_table.test.tsx
index 2fafbc6de98e49..820f8393d933d8 100644
--- a/x-pack/plugins/index_lifecycle_management/__jest__/policy_table.test.tsx
+++ b/x-pack/plugins/index_lifecycle_management/__jest__/policy_table.test.tsx
@@ -19,10 +19,11 @@ import { HttpService } from '../../../../src/core/public/http';
 import { usageCollectionPluginMock } from '../../../../src/plugins/usage_collection/public/mocks';
 
 import { PolicyFromES } from '../common/types';
-import { PolicyTable } from '../public/application/sections/policy_table/policy_table';
+import { PolicyList } from '../public/application/sections/policy_list/policy_list';
 import { init as initHttp } from '../public/application/services/http';
 import { init as initUiMetric } from '../public/application/services/ui_metric';
 import { KibanaContextProvider } from '../public/shared_imports';
+import { PolicyListContextProvider } from '../public/application/sections/policy_list/policy_list_context';
 
 initHttp(
   new HttpService().setup({
@@ -34,7 +35,7 @@ initUiMetric(usageCollectionPluginMock.createSetupContract());
 
 // use a date far in the past to check the sorting
 const testDate = '2020-07-21T14:16:58.666Z';
-const testDateFormatted = moment(testDate).format('YYYY-MM-DD HH:mm:ss');
+const testDateFormatted = moment(testDate).format('MMM D, YYYY');
 
 const testPolicy = {
   version: 0,
@@ -78,127 +79,120 @@ const snapshot = (rendered: string[]) => {
 const mountedSnapshot = (rendered: ReactWrapper) => {
   expect(takeMountedSnapshot(rendered)).toMatchSnapshot();
 };
-const names = (rendered: ReactWrapper) => {
+const getPolicyLinks = (rendered: ReactWrapper) => {
   return findTestSubject(rendered, 'policyTablePolicyNameLink');
 };
-const namesText = (rendered: ReactWrapper): string[] => {
-  return (names(rendered) as ReactWrapper).map((button) => button.text());
+const getPolicyNames = (rendered: ReactWrapper): string[] => {
+  return (getPolicyLinks(rendered) as ReactWrapper).map((button) => button.text());
 };
 
 const testSort = (headerName: string) => {
   const rendered = mountWithIntl(component);
-  const nameHeader = findTestSubject(rendered, `policyTableHeaderCell-${headerName}`).find(
-    'button'
-  );
+  const nameHeader = findTestSubject(rendered, `tableHeaderCell_${headerName}`).find('button');
   nameHeader.simulate('click');
   rendered.update();
-  snapshot(namesText(rendered));
+  snapshot(getPolicyNames(rendered));
   nameHeader.simulate('click');
   rendered.update();
-  snapshot(namesText(rendered));
-};
-const openContextMenu = (buttonIndex: number) => {
-  const rendered = mountWithIntl(component);
-  const actionsButton = findTestSubject(rendered, 'policyActionsContextMenuButton');
-  actionsButton.at(buttonIndex).simulate('click');
-  rendered.update();
-  return rendered;
+  snapshot(getPolicyNames(rendered));
 };
 
+const TestComponent = ({ testPolicies }: { testPolicies: PolicyFromES[] }) => {
+  return (
+    <KibanaContextProvider services={{ getUrlForApp: () => '' }}>
+      <PolicyListContextProvider>
+        <PolicyList updatePolicies={jest.fn()} policies={testPolicies} />
+      </PolicyListContextProvider>
+    </KibanaContextProvider>
+  );
+};
 describe('policy table', () => {
   beforeEach(() => {
-    component = (
-      <KibanaContextProvider services={{ getUrlForApp: () => '' }}>
-        <PolicyTable policies={policies} updatePolicies={jest.fn()} />
-      </KibanaContextProvider>
-    );
+    component = <TestComponent testPolicies={policies} />;
   });
 
-  test('should show empty state when there are not any policies', () => {
-    component = <PolicyTable policies={[]} updatePolicies={jest.fn()} />;
+  test('shows empty state when there are no policies', () => {
+    component = <TestComponent testPolicies={[]} />;
     const rendered = mountWithIntl(component);
     mountedSnapshot(rendered);
   });
-  test('should change pages when a pagination link is clicked on', () => {
+  test('changes pages when a pagination link is clicked on', () => {
     const rendered = mountWithIntl(component);
-    snapshot(namesText(rendered));
+    snapshot(getPolicyNames(rendered));
     const pagingButtons = rendered.find('.euiPaginationButton');
     pagingButtons.at(2).simulate('click');
     rendered.update();
-    snapshot(namesText(rendered));
+    snapshot(getPolicyNames(rendered));
   });
-  test('should show more when per page value is increased', () => {
+  test('shows more policies when "Rows per page" value is increased', () => {
     const rendered = mountWithIntl(component);
     const perPageButton = rendered.find('EuiTablePagination EuiPopover').find('button');
     perPageButton.simulate('click');
     rendered.update();
-    const fiftyButton = rendered.find('.euiContextMenuItem').at(1);
-    fiftyButton.simulate('click');
+    const numberOfRowsButton = rendered.find('.euiContextMenuItem').at(1);
+    numberOfRowsButton.simulate('click');
     rendered.update();
-    expect(namesText(rendered).length).toBe(50);
+    expect(getPolicyNames(rendered).length).toBe(25);
   });
-  test('should filter based on content of search input', () => {
+  test('filters based on content of search input', () => {
     const rendered = mountWithIntl(component);
     const searchInput = rendered.find('.euiFieldSearch').first();
     ((searchInput.instance() as unknown) as HTMLInputElement).value = 'testy0';
     searchInput.simulate('keyup', { key: 'Enter', keyCode: 13, which: 13 });
     rendered.update();
-    snapshot(namesText(rendered));
-  });
-  test('should sort when name header is clicked', () => {
-    testSort('name');
-  });
-  test('should sort when version header is clicked', () => {
-    testSort('version');
-  });
-  test('should sort when modified date header is clicked', () => {
-    testSort('modifiedDate');
-  });
-  test('should sort when linked indices header is clicked', () => {
-    testSort('indices');
-  });
-  test('should sort when linked index templates header is clicked', () => {
-    testSort('indexTemplates');
-  });
-  test('should have proper actions in context menu when there are linked indices', () => {
-    const rendered = openContextMenu(0);
-    const buttons = rendered.find('button.euiContextMenuItem');
-    expect(buttons.length).toBe(3);
-    expect(buttons.at(0).text()).toBe('View indices linked to policy');
-    expect(buttons.at(1).text()).toBe('Add policy to index template');
-    expect(buttons.at(2).text()).toBe('Delete policy');
-    expect((buttons.at(2).getDOMNode() as HTMLButtonElement).disabled).toBeTruthy();
-  });
-  test('should have proper actions in context menu when there are not linked indices', () => {
-    const rendered = openContextMenu(1);
-    const buttons = rendered.find('button.euiContextMenuItem');
-    expect(buttons.length).toBe(2);
-    expect(buttons.at(0).text()).toBe('Add policy to index template');
-    expect(buttons.at(1).text()).toBe('Delete policy');
-    expect((buttons.at(1).getDOMNode() as HTMLButtonElement).disabled).toBeFalsy();
-  });
-  test('confirmation modal should show when delete button is pressed', () => {
-    const rendered = openContextMenu(1);
-    const deleteButton = rendered.find('button.euiContextMenuItem').at(1);
-    deleteButton.simulate('click');
+    snapshot(getPolicyNames(rendered));
+  });
+  test('sorts when name header is clicked', () => {
+    testSort('name_0');
+  });
+  test('sorts when modified date header is clicked', () => {
+    testSort('modifiedDate_3');
+  });
+  test('sorts when linked indices header is clicked', () => {
+    testSort('indices_2');
+  });
+  test('sorts when linked index templates header is clicked', () => {
+    testSort('indexTemplates_1');
+  });
+  test('delete policy button is disabled when there are linked indices', () => {
+    const rendered = mountWithIntl(component);
+    const policyRow = findTestSubject(rendered, `policyTableRow-${testPolicy.name}`);
+    const deleteButton = findTestSubject(policyRow, 'deletePolicy');
+    expect(deleteButton.props().disabled).toBeTruthy();
+  });
+  test('delete policy button is enabled when there are no linked indices', () => {
+    const rendered = mountWithIntl(component);
+    const policyRow = findTestSubject(rendered, `policyTableRow-testy1`);
+    const deleteButton = findTestSubject(policyRow, 'deletePolicy');
+    expect(deleteButton.props().disabled).toBeFalsy();
+  });
+  test('confirmation modal shows when delete button is pressed', () => {
+    const rendered = mountWithIntl(component);
+    const policyRow = findTestSubject(rendered, `policyTableRow-testy1`);
+    const addPolicyToTemplateButton = findTestSubject(policyRow, 'deletePolicy');
+    addPolicyToTemplateButton.simulate('click');
     rendered.update();
-    expect(rendered.find('.euiModal--confirmation').exists()).toBeTruthy();
+    expect(findTestSubject(rendered, 'deletePolicyModal').exists()).toBeTruthy();
   });
-  test('confirmation modal should show when add policy to index template button is pressed', () => {
-    const rendered = openContextMenu(1);
-    const deleteButton = rendered.find('button.euiContextMenuItem').at(0);
-    deleteButton.simulate('click');
+  test('add index template modal shows when add policy to index template button is pressed', () => {
+    const rendered = mountWithIntl(component);
+    const policyRow = findTestSubject(rendered, `policyTableRow-${testPolicy.name}`);
+    const addPolicyToTemplateButton = findTestSubject(policyRow, 'addPolicyToTemplate');
+    addPolicyToTemplateButton.simulate('click');
     rendered.update();
-    expect(rendered.find('.euiModal--confirmation').exists()).toBeTruthy();
+    expect(findTestSubject(rendered, 'addPolicyToTemplateModal').exists()).toBeTruthy();
   });
   test('displays policy properties', () => {
     const rendered = mountWithIntl(component);
-    const firstRow = findTestSubject(rendered, 'policyTableRow-testy0').text();
-    const numberOfIndices = testPolicy.indices.length;
-    const numberOfIndexTemplates = testPolicy.indexTemplates.length;
-    expect(firstRow).toBe(
-      `testy0${numberOfIndices}${numberOfIndexTemplates}${testPolicy.version}${testDateFormatted}Actions`
-    );
+    const firstRow = findTestSubject(rendered, 'policyTableRow-testy0');
+    const policyName = findTestSubject(firstRow, 'policy-name').text();
+    expect(policyName).toBe(`Name${testPolicy.name}`);
+    const policyIndexTemplates = findTestSubject(firstRow, 'policy-indexTemplates').text();
+    expect(policyIndexTemplates).toBe(`Linked index templates${testPolicy.indexTemplates.length}`);
+    const policyIndices = findTestSubject(firstRow, 'policy-indices').text();
+    expect(policyIndices).toBe(`Linked indices${testPolicy.indices.length}`);
+    const policyModifiedDate = findTestSubject(firstRow, 'policy-modifiedDate').text();
+    expect(policyModifiedDate).toBe(`Modified date${testDateFormatted}`);
   });
   test('opens a flyout with index templates', () => {
     const rendered = mountWithIntl(component);
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/app.tsx b/x-pack/plugins/index_lifecycle_management/public/application/app.tsx
index 4bc4e62ac52b61..89d19bb7edad5d 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/app.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/app.tsx
@@ -12,7 +12,7 @@ import { METRIC_TYPE } from '@kbn/analytics';
 
 import { UIM_APP_LOAD } from './constants';
 import { EditPolicy } from './sections/edit_policy';
-import { PolicyTable } from './sections/policy_table';
+import { PolicyList } from './sections/policy_list';
 import { trackUiMetric } from './services/ui_metric';
 import { ROUTES } from './services/navigation';
 
@@ -23,7 +23,7 @@ export const App = ({ history }: { history: ScopedHistory }) => {
     <Router history={history}>
       <Switch>
         <Redirect exact from="/" to={ROUTES.list} />
-        <Route exact path={ROUTES.list} component={PolicyTable} />
+        <Route exact path={ROUTES.list} component={PolicyList} />
         <Route path={ROUTES.edit} component={EditPolicy} />
       </Switch>
     </Router>
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/lib/policies.ts b/x-pack/plugins/index_lifecycle_management/public/application/lib/policies.ts
index 4d16fadef5a1a3..703ab8626e91fc 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/lib/policies.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/lib/policies.ts
@@ -31,3 +31,6 @@ export const getPolicyByName = (
     return policies.find((policy: PolicyFromES) => policy.name === policyName);
   }
 };
+
+export const hasLinkedIndices = (policy: PolicyFromES) =>
+  Boolean(policy.indices && policy.indices.length);
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/add_policy_to_template_confirm_modal.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/components/add_policy_to_template_confirm_modal.tsx
similarity index 98%
rename from x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/add_policy_to_template_confirm_modal.tsx
rename to x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/components/add_policy_to_template_confirm_modal.tsx
index 35af725d6010cc..18852ac5ab68fa 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/add_policy_to_template_confirm_modal.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/components/add_policy_to_template_confirm_modal.tsx
@@ -30,11 +30,13 @@ import { LearnMoreLink } from '../../edit_policy/components';
 
 interface Props {
   policy: PolicyFromES;
+  onSuccess: (indexTemplate: string) => void;
   onCancel: () => void;
 }
 
 export const AddPolicyToTemplateConfirmModal: React.FunctionComponent<Props> = ({
   policy,
+  onSuccess,
   onCancel,
 }) => {
   const [isLegacy, setIsLegacy] = useState<boolean>(false);
@@ -234,7 +236,7 @@ export const AddPolicyToTemplateConfirmModal: React.FunctionComponent<Props> = (
         }
       );
       toasts.addSuccess(message);
-      onCancel();
+      onSuccess(templateName);
     } catch (e) {
       const title = i18n.translate(
         'xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.errorMessage',
@@ -257,6 +259,7 @@ export const AddPolicyToTemplateConfirmModal: React.FunctionComponent<Props> = (
 
   return (
     <EuiConfirmModal
+      data-test-subj="addPolicyToTemplateModal"
       title={title}
       onCancel={onCancel}
       onConfirm={addPolicyToTemplate}
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/confirm_delete.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/components/confirm_delete.tsx
similarity index 98%
rename from x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/confirm_delete.tsx
rename to x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/components/confirm_delete.tsx
index e42aa97a10d4f1..a36adf6135f847 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/confirm_delete.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/components/confirm_delete.tsx
@@ -51,6 +51,7 @@ export class ConfirmDelete extends Component<Props> {
     });
     return (
       <EuiConfirmModal
+        data-test-subj="deletePolicyModal"
         title={title}
         onCancel={onCancel}
         onConfirm={this.deletePolicy}
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/components/list_action_handler.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/components/list_action_handler.tsx
new file mode 100644
index 00000000000000..c03bdddc5aefd3
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/components/list_action_handler.tsx
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { usePolicyListContext } from '../policy_list_context';
+import { IndexTemplatesFlyout } from '../../../components/index_templates_flyout';
+import { ConfirmDelete } from './confirm_delete';
+import { AddPolicyToTemplateConfirmModal } from './add_policy_to_template_confirm_modal';
+
+interface Props {
+  updatePolicies: () => void;
+}
+export const ListActionHandler: React.FunctionComponent<Props> = ({ updatePolicies }) => {
+  const { listAction, setListAction } = usePolicyListContext();
+  if (listAction?.actionType === 'viewIndexTemplates') {
+    return (
+      <IndexTemplatesFlyout
+        policy={listAction.selectedPolicy}
+        close={() => {
+          setListAction(null);
+        }}
+      />
+    );
+  }
+  if (listAction?.actionType === 'deletePolicy') {
+    return (
+      <ConfirmDelete
+        policyToDelete={listAction.selectedPolicy}
+        callback={() => {
+          updatePolicies();
+          setListAction(null);
+        }}
+        onCancel={() => {
+          setListAction(null);
+        }}
+      />
+    );
+  }
+
+  if (listAction?.actionType === 'addIndexTemplate') {
+    return (
+      <AddPolicyToTemplateConfirmModal
+        policy={listAction.selectedPolicy}
+        onSuccess={(indexTemplate: string) => {
+          // update the linked index templates of the selected policy
+          listAction!.selectedPolicy.indexTemplates = [
+            ...(listAction!.selectedPolicy.indexTemplates || []),
+            indexTemplate,
+          ];
+          setListAction(null);
+        }}
+        onCancel={() => setListAction(null)}
+      />
+    );
+  }
+  return null;
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/components/policy_table.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/components/policy_table.tsx
new file mode 100644
index 00000000000000..4d75b43530fd7f
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/components/policy_table.tsx
@@ -0,0 +1,214 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiButtonEmpty, EuiLink, EuiInMemoryTable, EuiToolTip, EuiButtonIcon } from '@elastic/eui';
+
+import { i18n } from '@kbn/i18n';
+
+import moment from 'moment';
+import { METRIC_TYPE } from '@kbn/analytics';
+import { useHistory } from 'react-router-dom';
+import { EuiBasicTableColumn } from '@elastic/eui/src/components/basic_table/basic_table';
+import { reactRouterNavigate } from '../../../../../../../../src/plugins/kibana_react/public';
+import { getIndexListUri } from '../../../../../../index_management/public';
+import { PolicyFromES } from '../../../../../common/types';
+import { useKibana } from '../../../../shared_imports';
+import { getPolicyEditPath } from '../../../services/navigation';
+import { trackUiMetric } from '../../../services/ui_metric';
+
+import { UIM_EDIT_CLICK } from '../../../constants';
+import { hasLinkedIndices } from '../../../lib/policies';
+import { usePolicyListContext } from '../policy_list_context';
+
+const actionTooltips = {
+  deleteEnabled: i18n.translate('xpack.indexLifecycleMgmt.policyTable.deletePolicyButtonText', {
+    defaultMessage: 'Delete policy',
+  }),
+  deleteDisabled: i18n.translate(
+    'xpack.indexLifecycleMgmt.policyTable.deletePolicyButtonDisabledTooltip',
+    {
+      defaultMessage: 'You cannot delete a policy that is being used by an index',
+    }
+  ),
+  viewIndices: i18n.translate('xpack.indexLifecycleMgmt.policyTable.viewIndicesButtonText', {
+    defaultMessage: 'View indices linked to policy',
+  }),
+  addIndexTemplate: i18n.translate(
+    'xpack.indexLifecycleMgmt.policyTable.addPolicyToTemplateButtonText',
+    {
+      defaultMessage: 'Add policy to index template',
+    }
+  ),
+};
+
+interface Props {
+  policies: PolicyFromES[];
+}
+
+export const PolicyTable: React.FunctionComponent<Props> = ({ policies }) => {
+  const history = useHistory();
+  const {
+    services: { navigateToApp },
+  } = useKibana();
+
+  const { setListAction } = usePolicyListContext();
+
+  const columns: Array<EuiBasicTableColumn<PolicyFromES>> = [
+    {
+      'data-test-subj': 'policy-name',
+      field: 'name',
+      name: i18n.translate('xpack.indexLifecycleMgmt.policyTable.headers.nameHeader', {
+        defaultMessage: 'Name',
+      }),
+      sortable: true,
+      render: (value: string) => {
+        return (
+          <EuiLink
+            className="eui-textBreakAll"
+            data-test-subj="policyTablePolicyNameLink"
+            {...reactRouterNavigate(history, getPolicyEditPath(value), () =>
+              trackUiMetric(METRIC_TYPE.CLICK, UIM_EDIT_CLICK)
+            )}
+          >
+            {value}
+          </EuiLink>
+        );
+      },
+    },
+    {
+      'data-test-subj': 'policy-indexTemplates',
+      field: 'indexTemplates',
+      name: i18n.translate('xpack.indexLifecycleMgmt.policyTable.headers.indexTemplatesHeader', {
+        defaultMessage: 'Linked index templates',
+      }),
+      sortable: ({ indexTemplates }) => (indexTemplates ?? []).length,
+      render: (value: string[], policy: PolicyFromES) => {
+        return value && value.length > 0 ? (
+          <EuiToolTip content={actionTooltips.viewIndices} position="left">
+            <EuiButtonEmpty
+              flush="both"
+              data-test-subj="viewIndexTemplates"
+              onClick={() =>
+                setListAction({ selectedPolicy: policy, actionType: 'viewIndexTemplates' })
+              }
+            >
+              {value.length}
+            </EuiButtonEmpty>
+          </EuiToolTip>
+        ) : (
+          '0'
+        );
+      },
+    },
+    {
+      'data-test-subj': 'policy-indices',
+      field: 'indices',
+      name: i18n.translate('xpack.indexLifecycleMgmt.policyTable.headers.linkedIndicesHeader', {
+        defaultMessage: 'Linked indices',
+      }),
+      sortable: ({ indices }) => (indices ?? []).length,
+      render: (value: string[], policy: PolicyFromES) => {
+        return value && value.length > 0 ? (
+          <EuiToolTip content={actionTooltips.viewIndices} position="left">
+            <EuiButtonEmpty
+              flush="both"
+              onClick={() =>
+                navigateToApp('management', {
+                  path: `/data/index_management${getIndexListUri(
+                    `ilm.policy:"${policy.name}"`,
+                    true
+                  )}`,
+                })
+              }
+            >
+              {value.length}
+            </EuiButtonEmpty>
+          </EuiToolTip>
+        ) : (
+          '0'
+        );
+      },
+    },
+    {
+      'data-test-subj': 'policy-modifiedDate',
+      field: 'modifiedDate',
+      name: i18n.translate('xpack.indexLifecycleMgmt.policyTable.headers.modifiedDateHeader', {
+        defaultMessage: 'Modified date',
+      }),
+      sortable: true,
+      render: (value: string) => {
+        return value ? moment(value).format('MMM D, YYYY') : value;
+      },
+    },
+    {
+      actions: [
+        {
+          render: (policy: PolicyFromES) => {
+            return (
+              <EuiToolTip content={actionTooltips.addIndexTemplate}>
+                <EuiButtonIcon
+                  data-test-subj="addPolicyToTemplate"
+                  onClick={() =>
+                    setListAction({ selectedPolicy: policy, actionType: 'addIndexTemplate' })
+                  }
+                  iconType="plusInCircle"
+                  aria-label={actionTooltips.addIndexTemplate}
+                />
+              </EuiToolTip>
+            );
+          },
+        },
+        {
+          render: (policy: PolicyFromES, enabled: boolean) => {
+            return (
+              <EuiToolTip
+                content={enabled ? actionTooltips.deleteEnabled : actionTooltips.deleteDisabled}
+              >
+                <EuiButtonIcon
+                  data-test-subj="deletePolicy"
+                  onClick={() =>
+                    setListAction({ selectedPolicy: policy, actionType: 'deletePolicy' })
+                  }
+                  iconType="trash"
+                  aria-label={actionTooltips.deleteEnabled}
+                  disabled={!enabled}
+                />
+              </EuiToolTip>
+            );
+          },
+          enabled: (policy: PolicyFromES) => !hasLinkedIndices(policy),
+        },
+      ],
+      name: i18n.translate('xpack.indexLifecycleMgmt.policyTable.headers.actionsHeader', {
+        defaultMessage: 'Actions',
+      }),
+    },
+  ];
+
+  return (
+    <EuiInMemoryTable
+      tableCaption={i18n.translate('xpack.indexLifecycleMgmt.policyTable.captionText', {
+        defaultMessage:
+          'The table below contains {count, plural, one {# Index Lifecycle policy} other {# Index Lifecycle policies}} .',
+        values: { count: policies.length },
+      })}
+      pagination={true}
+      sorting={{
+        sort: {
+          field: 'name',
+          direction: 'asc',
+        },
+      }}
+      search={{ box: { incremental: true } }}
+      tableLayout="auto"
+      items={policies}
+      columns={columns}
+      rowProps={(policy: PolicyFromES) => ({ 'data-test-subj': `policyTableRow-${policy.name}` })}
+    />
+  );
+};
diff --git a/x-pack/plugins/apm/common/ui_settings_keys.ts b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/index.ts
similarity index 79%
rename from x-pack/plugins/apm/common/ui_settings_keys.ts
rename to x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/index.ts
index 427c30605e71b8..4a1759dcbabcc7 100644
--- a/x-pack/plugins/apm/common/ui_settings_keys.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/index.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export const enableServiceOverview = 'apm:enableServiceOverview';
+export { PolicyList } from './policy_list.container';
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/policy_table.container.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/policy_list.container.tsx
similarity index 85%
rename from x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/policy_table.container.tsx
rename to x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/policy_list.container.tsx
index 376832bc990615..ed5c8d26a46c81 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/policy_table.container.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/policy_list.container.tsx
@@ -8,11 +8,12 @@
 import React, { useEffect } from 'react';
 import { EuiButton, EuiEmptyPrompt, EuiLoadingSpinner, EuiPageContent } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { PolicyTable as PresentationComponent } from './policy_table';
+import { PolicyList as PresentationComponent } from './policy_list';
 import { useKibana } from '../../../shared_imports';
 import { useLoadPoliciesList } from '../../services/api';
+import { PolicyListContextProvider } from './policy_list_context';
 
-export const PolicyTable: React.FunctionComponent = () => {
+export const PolicyList: React.FunctionComponent = () => {
   const {
     services: { breadcrumbService },
   } = useKibana();
@@ -68,5 +69,9 @@ export const PolicyTable: React.FunctionComponent = () => {
     );
   }
 
-  return <PresentationComponent policies={policies || []} updatePolicies={resendRequest} />;
+  return (
+    <PolicyListContextProvider>
+      <PresentationComponent policies={policies || []} updatePolicies={resendRequest} />
+    </PolicyListContextProvider>
+  );
 };
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/policy_table.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/policy_list.tsx
similarity index 51%
rename from x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/policy_table.tsx
rename to x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/policy_list.tsx
index 28cc2b17dcbff2..e25a43cc6d4dcc 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/policy_table.tsx
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/policy_list.tsx
@@ -5,35 +5,23 @@
  * 2.0.
  */
 
-import React, { Fragment, ReactElement, ReactNode, useState } from 'react';
-import { i18n } from '@kbn/i18n';
+import React, { Fragment } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
 
-import {
-  EuiButton,
-  EuiEmptyPrompt,
-  EuiFieldSearch,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiSpacer,
-  EuiPageHeader,
-  EuiPageContent,
-} from '@elastic/eui';
+import { EuiButton, EuiEmptyPrompt, EuiSpacer, EuiPageHeader, EuiPageContent } from '@elastic/eui';
 import { useHistory } from 'react-router-dom';
 import { reactRouterNavigate } from '../../../../../../../src/plugins/kibana_react/public';
 import { PolicyFromES } from '../../../../common/types';
-import { filterItems } from '../../services';
-import { TableContent } from './components/table_content';
+import { PolicyTable } from './components/policy_table';
 import { getPolicyCreatePath } from '../../services/navigation';
+import { ListActionHandler } from './components/list_action_handler';
 
 interface Props {
   policies: PolicyFromES[];
   updatePolicies: () => void;
 }
 
-export const PolicyTable: React.FunctionComponent<Props> = ({ policies, updatePolicies }) => {
-  const [confirmModal, setConfirmModal] = useState<ReactNode | null>();
-  const [filter, setFilter] = useState<string>('');
+export const PolicyList: React.FunctionComponent<Props> = ({ policies, updatePolicies }) => {
   const history = useHistory();
 
   const createPolicyButton = (
@@ -50,65 +38,7 @@ export const PolicyTable: React.FunctionComponent<Props> = ({ policies, updatePo
     </EuiButton>
   );
 
-  let content: ReactElement;
-
-  if (policies.length > 0) {
-    const filteredPolicies = filterItems('name', filter, policies);
-    let tableContent: ReactElement;
-    if (filteredPolicies.length > 0) {
-      tableContent = (
-        <TableContent
-          policies={filteredPolicies}
-          totalNumber={policies.length}
-          setConfirmModal={setConfirmModal}
-          handleDelete={() => {
-            updatePolicies();
-            setConfirmModal(null);
-          }}
-        />
-      );
-    } else {
-      tableContent = (
-        <FormattedMessage
-          id="xpack.indexLifecycleMgmt.noMatch.noPolicicesDescription"
-          defaultMessage="No policies to show"
-        />
-      );
-    }
-
-    // Wrapping the actual contents inside a div, otherwise the table layout will get messed up
-    // if the table size changes (ie: applying a filter) due to the flex props of the page wrapper.
-    content = (
-      <div>
-        <EuiFlexGroup gutterSize="l" alignItems="center">
-          <EuiFlexItem>
-            <EuiFieldSearch
-              fullWidth
-              value={filter}
-              onChange={(event) => {
-                setFilter(event.target.value);
-              }}
-              data-test-subj="policyTableFilterInput"
-              placeholder={i18n.translate(
-                'xpack.indexLifecycleMgmt.policyTable.systempoliciesSearchInputPlaceholder',
-                {
-                  defaultMessage: 'Search',
-                }
-              )}
-              aria-label={i18n.translate(
-                'xpack.indexLifecycleMgmt.policyTable.systempoliciesSearchInputAriaLabel',
-                {
-                  defaultMessage: 'Search policies',
-                }
-              )}
-            />
-          </EuiFlexItem>
-        </EuiFlexGroup>
-        <EuiSpacer size="m" />
-        {tableContent}
-      </div>
-    );
-  } else {
+  if (policies.length === 0) {
     return (
       <EuiPageContent verticalPosition="center" horizontalPosition="center" color="subdued">
         <EuiEmptyPrompt
@@ -139,7 +69,7 @@ export const PolicyTable: React.FunctionComponent<Props> = ({ policies, updatePo
 
   return (
     <>
-      {confirmModal}
+      <ListActionHandler updatePolicies={updatePolicies} />
 
       <EuiPageHeader
         pageTitle={
@@ -163,7 +93,7 @@ export const PolicyTable: React.FunctionComponent<Props> = ({ policies, updatePo
 
       <EuiSpacer size="l" />
 
-      {content}
+      <PolicyTable policies={policies} />
     </>
   );
 };
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/policy_list_context.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/policy_list_context.tsx
new file mode 100644
index 00000000000000..a77aac9ad2f118
--- /dev/null
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_list/policy_list_context.tsx
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { createContext, ReactChild, useContext, useState } from 'react';
+import { PolicyFromES } from '../../../../common/types';
+
+interface ListAction {
+  actionType: 'viewIndexTemplates' | 'addIndexTemplate' | 'deletePolicy';
+  selectedPolicy: PolicyFromES;
+}
+
+export interface PolicyListContextValue {
+  listAction: ListAction | null;
+  setListAction: (policyAction: ListAction | null) => void;
+}
+
+const PolicyListContext = createContext<PolicyListContextValue>({
+  listAction: null,
+  setListAction: () => {},
+});
+
+export const PolicyListContextProvider = ({ children }: { children: ReactChild }) => {
+  const [listAction, setListAction] = useState<ListAction | null>(null);
+
+  return (
+    <PolicyListContext.Provider
+      value={{
+        listAction,
+        setListAction,
+      }}
+    >
+      {children}
+    </PolicyListContext.Provider>
+  );
+};
+
+export const usePolicyListContext = (): PolicyListContextValue => {
+  const ctx = useContext(PolicyListContext);
+  if (!ctx) {
+    throw new Error('usePolicyListContext can only be called inside of PolicyListContext!');
+  }
+  return ctx;
+};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/table_content.tsx b/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/table_content.tsx
deleted file mode 100644
index 94d815b7ef932a..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/components/table_content.tsx
+++ /dev/null
@@ -1,414 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { ReactElement, useState, Fragment, ReactNode } from 'react';
-import {
-  EuiButtonEmpty,
-  EuiContextMenu,
-  EuiLink,
-  EuiPopover,
-  EuiScreenReaderOnly,
-  EuiSpacer,
-  EuiTable,
-  EuiTableBody,
-  EuiTableHeader,
-  EuiTableHeaderCell,
-  EuiTablePagination,
-  EuiTableRow,
-  EuiTableRowCell,
-  Pager,
-  EuiContextMenuPanelDescriptor,
-} from '@elastic/eui';
-
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
-import { RIGHT_ALIGNMENT } from '@elastic/eui/lib/services';
-
-import moment from 'moment';
-import { METRIC_TYPE } from '@kbn/analytics';
-import { useHistory } from 'react-router-dom';
-import { reactRouterNavigate } from '../../../../../../../../src/plugins/kibana_react/public';
-import { getIndexListUri } from '../../../../../../index_management/public';
-import { PolicyFromES } from '../../../../../common/types';
-import { useKibana } from '../../../../shared_imports';
-import { getPolicyEditPath } from '../../../services/navigation';
-import { sortTable } from '../../../services';
-import { trackUiMetric } from '../../../services/ui_metric';
-
-import { UIM_EDIT_CLICK } from '../../../constants';
-import { TableColumn } from '../index';
-import { AddPolicyToTemplateConfirmModal } from './add_policy_to_template_confirm_modal';
-import { ConfirmDelete } from './confirm_delete';
-import { IndexTemplatesFlyout } from '../../../components/index_templates_flyout';
-
-const COLUMNS: Array<[TableColumn, { label: string; width: number }]> = [
-  [
-    'name',
-    {
-      label: i18n.translate('xpack.indexLifecycleMgmt.policyTable.headers.nameHeader', {
-        defaultMessage: 'Name',
-      }),
-      width: 200,
-    },
-  ],
-  [
-    'indices',
-    {
-      label: i18n.translate('xpack.indexLifecycleMgmt.policyTable.headers.linkedIndicesHeader', {
-        defaultMessage: 'Linked indices',
-      }),
-      width: 120,
-    },
-  ],
-  [
-    'indexTemplates',
-    {
-      label: i18n.translate(
-        'xpack.indexLifecycleMgmt.policyTable.headers.linkedIndexTemplatesHeader',
-        {
-          defaultMessage: 'Linked index templates',
-        }
-      ),
-      width: 160,
-    },
-  ],
-  [
-    'version',
-    {
-      label: i18n.translate('xpack.indexLifecycleMgmt.policyTable.headers.versionHeader', {
-        defaultMessage: 'Version',
-      }),
-      width: 120,
-    },
-  ],
-  [
-    'modifiedDate',
-    {
-      label: i18n.translate('xpack.indexLifecycleMgmt.policyTable.headers.modifiedDateHeader', {
-        defaultMessage: 'Modified date',
-      }),
-      width: 200,
-    },
-  ],
-];
-
-interface Props {
-  policies: PolicyFromES[];
-  totalNumber: number;
-  setConfirmModal: (modal: ReactElement | null) => void;
-  handleDelete: () => void;
-}
-export const TableContent: React.FunctionComponent<Props> = ({
-  policies,
-  totalNumber,
-  setConfirmModal,
-  handleDelete,
-}) => {
-  const [popoverPolicy, setPopoverPolicy] = useState<string>();
-  const [sort, setSort] = useState<{ sortField: TableColumn; isSortAscending: boolean }>({
-    sortField: 'name',
-    isSortAscending: true,
-  });
-  const [pageSize, setPageSize] = useState<number>(10);
-  const [currentPage, setCurrentPage] = useState<number>(0);
-  const history = useHistory();
-  const {
-    services: { navigateToApp },
-  } = useKibana();
-
-  let sortedPolicies = sortTable(policies, sort.sortField, sort.isSortAscending);
-  const pager = new Pager(totalNumber, pageSize, currentPage);
-  const { firstItemIndex, lastItemIndex } = pager;
-  sortedPolicies = sortedPolicies.slice(firstItemIndex, lastItemIndex + 1);
-
-  const isPolicyPopoverOpen = (policyName: string): boolean => popoverPolicy === policyName;
-  const closePolicyPopover = (): void => {
-    setPopoverPolicy('');
-  };
-  const openPolicyPopover = (policyName: string): void => {
-    setPopoverPolicy(policyName);
-  };
-  const togglePolicyPopover = (policyName: string): void => {
-    if (isPolicyPopoverOpen(policyName)) {
-      closePolicyPopover();
-    } else {
-      openPolicyPopover(policyName);
-    }
-  };
-
-  const onSort = (column: TableColumn) => {
-    const newIsSortAscending = sort.sortField === column ? !sort.isSortAscending : true;
-    setSort({ sortField: column, isSortAscending: newIsSortAscending });
-  };
-
-  const headers = [];
-  COLUMNS.forEach(([fieldName, { label, width }]) => {
-    const isSorted = sort.sortField === fieldName;
-    headers.push(
-      <EuiTableHeaderCell
-        key={fieldName}
-        onSort={() => onSort(fieldName)}
-        isSorted={isSorted}
-        isSortAscending={sort.isSortAscending}
-        data-test-subj={`policyTableHeaderCell-${fieldName}`}
-        className={'policyTable__header--' + fieldName}
-        width={width}
-      >
-        {label}
-      </EuiTableHeaderCell>
-    );
-  });
-  headers.push(
-    <EuiTableHeaderCell
-      key="deleteHeader"
-      data-test-subj="policyTableHeaderCell-delete"
-      width={150}
-    />
-  );
-
-  const buildActionPanelTree = (policy: PolicyFromES): EuiContextMenuPanelDescriptor[] => {
-    const hasLinkedIndices = Boolean(policy.indices && policy.indices.length);
-
-    const viewIndicesLabel = i18n.translate(
-      'xpack.indexLifecycleMgmt.policyTable.viewIndicesButtonText',
-      {
-        defaultMessage: 'View indices linked to policy',
-      }
-    );
-    const addPolicyToTemplateLabel = i18n.translate(
-      'xpack.indexLifecycleMgmt.policyTable.addPolicyToTemplateButtonText',
-      {
-        defaultMessage: 'Add policy to index template',
-      }
-    );
-    const deletePolicyLabel = i18n.translate(
-      'xpack.indexLifecycleMgmt.policyTable.deletePolicyButtonText',
-      {
-        defaultMessage: 'Delete policy',
-      }
-    );
-    const deletePolicyTooltip = hasLinkedIndices
-      ? i18n.translate('xpack.indexLifecycleMgmt.policyTable.deletePolicyButtonDisabledTooltip', {
-          defaultMessage: 'You cannot delete a policy that is being used by an index',
-        })
-      : null;
-    const items = [];
-    if (hasLinkedIndices) {
-      items.push({
-        name: viewIndicesLabel,
-        icon: 'list',
-        onClick: () => {
-          navigateToApp('management', {
-            path: `/data/index_management${getIndexListUri(`ilm.policy:"${policy.name}"`, true)}`,
-          });
-        },
-      });
-    }
-    items.push({
-      name: addPolicyToTemplateLabel,
-      icon: 'plusInCircle',
-      onClick: () => {
-        setConfirmModal(renderAddPolicyToTemplateConfirmModal(policy));
-      },
-      'data-test-subj': 'addPolicyToTemplate',
-    });
-    items.push({
-      name: deletePolicyLabel,
-      disabled: hasLinkedIndices,
-      icon: 'trash',
-      toolTipContent: deletePolicyTooltip,
-      onClick: () => {
-        setConfirmModal(renderDeleteConfirmModal(policy));
-      },
-      'data-test-subj': 'deletePolicy',
-    });
-    const panelTree = {
-      id: 0,
-      title: i18n.translate('xpack.indexLifecycleMgmt.policyTable.policyActionsMenu.panelTitle', {
-        defaultMessage: 'Policy options',
-      }),
-      items,
-    };
-    return [panelTree];
-  };
-
-  const renderRowCell = (
-    fieldName: string,
-    value: string | number | string[],
-    policy?: PolicyFromES
-  ): ReactNode => {
-    if (fieldName === 'name') {
-      return (
-        <EuiLink
-          data-test-subj="policyTablePolicyNameLink"
-          {...reactRouterNavigate(history, getPolicyEditPath(value as string), () =>
-            trackUiMetric(METRIC_TYPE.CLICK, UIM_EDIT_CLICK)
-          )}
-        >
-          {value}
-        </EuiLink>
-      );
-    } else if (fieldName === 'indices') {
-      return value ? (value as string[]).length : '0';
-    } else if (fieldName === 'indexTemplates' && policy) {
-      return value && (value as string[]).length > 0 ? (
-        <EuiButtonEmpty
-          flush="left"
-          data-test-subj="viewIndexTemplates"
-          onClick={() => setConfirmModal(renderIndexTemplatesFlyout(policy))}
-        >
-          {(value as string[]).length}
-        </EuiButtonEmpty>
-      ) : (
-        '0'
-      );
-    } else if (fieldName === 'modifiedDate' && value) {
-      return moment(value).format('YYYY-MM-DD HH:mm:ss');
-    }
-    return value;
-  };
-
-  const renderRowCells = (policy: PolicyFromES): ReactElement[] => {
-    const { name } = policy;
-    const cells = [];
-    COLUMNS.forEach(([fieldName, { width }]) => {
-      const value: any = policy[fieldName];
-
-      if (fieldName === 'name') {
-        cells.push(
-          <th
-            key={`${fieldName}-${name}`}
-            className="euiTableRowCell"
-            scope="row"
-            data-test-subj={`policyTableCell-${fieldName}`}
-          >
-            <div className={`euiTableCellContent policyTable__content--${fieldName}`}>
-              {renderRowCell(fieldName, value)}
-            </div>
-          </th>
-        );
-      } else {
-        cells.push(
-          <EuiTableRowCell
-            key={`${fieldName}-${name}`}
-            truncateText={false}
-            data-test-subj={`policyTableCell-${fieldName}`}
-            className={'policyTable__content--' + fieldName}
-            width={width}
-          >
-            {renderRowCell(fieldName, value, policy)}
-          </EuiTableRowCell>
-        );
-      }
-    });
-    const button = (
-      <EuiButtonEmpty
-        data-test-subj="policyActionsContextMenuButton"
-        onClick={() => togglePolicyPopover(policy.name)}
-        color="primary"
-      >
-        {i18n.translate('xpack.indexLifecycleMgmt.policyTable.actionsButtonText', {
-          defaultMessage: 'Actions',
-        })}
-      </EuiButtonEmpty>
-    );
-    cells.push(
-      <EuiTableRowCell
-        align={RIGHT_ALIGNMENT}
-        key={`delete-${name}`}
-        truncateText={false}
-        data-test-subj={`policyTableCell-actions-${name}`}
-        style={{ width: 150 }}
-      >
-        <EuiPopover
-          id={`contextMenuPolicy-${name}`}
-          button={button}
-          isOpen={isPolicyPopoverOpen(policy.name)}
-          closePopover={closePolicyPopover}
-          panelPaddingSize="none"
-          anchorPosition="rightUp"
-          repositionOnScroll
-        >
-          <EuiContextMenu initialPanelId={0} panels={buildActionPanelTree(policy)} />
-        </EuiPopover>
-      </EuiTableRowCell>
-    );
-    return cells;
-  };
-
-  const rows = sortedPolicies.map((policy) => {
-    const { name } = policy;
-    return (
-      <EuiTableRow data-test-subj={`policyTableRow-${name}`} key={`${name}-row`}>
-        {renderRowCells(policy)}
-      </EuiTableRow>
-    );
-  });
-
-  const renderAddPolicyToTemplateConfirmModal = (policy: PolicyFromES): ReactElement => {
-    return (
-      <AddPolicyToTemplateConfirmModal policy={policy} onCancel={() => setConfirmModal(null)} />
-    );
-  };
-
-  const renderDeleteConfirmModal = (policy: PolicyFromES): ReactElement => {
-    return (
-      <ConfirmDelete
-        policyToDelete={policy}
-        callback={handleDelete}
-        onCancel={() => {
-          setConfirmModal(null);
-        }}
-      />
-    );
-  };
-
-  const renderIndexTemplatesFlyout = (policy: PolicyFromES): ReactElement => {
-    return (
-      <IndexTemplatesFlyout
-        policy={policy}
-        close={() => {
-          setConfirmModal(null);
-        }}
-      />
-    );
-  };
-
-  const renderPager = (): ReactNode => {
-    return (
-      <EuiTablePagination
-        activePage={pager.getCurrentPageIndex()}
-        itemsPerPage={pager.itemsPerPage}
-        itemsPerPageOptions={[10, 50, 100]}
-        pageCount={pager.getTotalPages()}
-        onChangeItemsPerPage={setPageSize}
-        onChangePage={setCurrentPage}
-      />
-    );
-  };
-
-  return (
-    <Fragment>
-      <EuiTable>
-        <EuiScreenReaderOnly>
-          <caption role="status" aria-relevant="text" aria-live="polite">
-            <FormattedMessage
-              id="xpack.indexLifecycleMgmt.policyTable.captionText"
-              defaultMessage="Below is the index lifecycle policy table
-                    containing {count, plural, one {# row} other {# rows}} out of {total}."
-              values={{ count: sortedPolicies.length, total: totalNumber }}
-            />
-          </caption>
-        </EuiScreenReaderOnly>
-        <EuiTableHeader>{headers}</EuiTableHeader>
-        <EuiTableBody>{rows}</EuiTableBody>
-      </EuiTable>
-      <EuiSpacer size="m" />
-      {policies.length > 10 ? renderPager() : null}
-    </Fragment>
-  );
-};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/filter_items.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/filter_items.ts
deleted file mode 100644
index 6de398b87d7dba..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/filter_items.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export const filterItems = <T>(field: keyof T, filter: string, items: T[] = []): T[] => {
-  const lowerFilter = filter.toLowerCase();
-  return items.filter((item: T) => {
-    const normalizedValue = String(item[field]).toLowerCase();
-    return normalizedValue.includes(lowerFilter);
-  });
-};
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/sort_table.ts b/x-pack/plugins/index_lifecycle_management/public/application/services/sort_table.ts
deleted file mode 100644
index 8c381f1e90daf6..00000000000000
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/sort_table.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { sortBy } from 'lodash';
-import { PolicyFromES } from '../../../common/types';
-import { TableColumn } from '../sections/policy_table';
-
-export const sortTable = (
-  array: PolicyFromES[] = [],
-  sortField: TableColumn,
-  isSortAscending: boolean
-): PolicyFromES[] => {
-  let sorter;
-  if (sortField === 'indices' || sortField === 'indexTemplates') {
-    sorter = (item: PolicyFromES) => (item[sortField] || []).length;
-  } else {
-    sorter = (item: PolicyFromES) => item[sortField];
-  }
-  const sorted = sortBy(array, sorter);
-  return isSortAscending ? sorted : sorted.reverse();
-};
diff --git a/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.tsx b/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.tsx
index 8835a7cd55ce82..be0ecbb1dab657 100644
--- a/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.tsx
+++ b/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.tsx
@@ -17,6 +17,8 @@ import {
   EuiToolTip,
   EuiIcon,
   EuiFieldSearch,
+  EuiAccordion,
+  EuiPanel,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
@@ -259,6 +261,11 @@ export const Expressions: React.FC<Props> = (props) => {
     return alertParams.groupBy;
   }, [alertParams.groupBy]);
 
+  const areAllAggsRate = useMemo(
+    () => alertParams.criteria?.every((c) => c.aggType === Aggregators.RATE),
+    [alertParams.criteria]
+  );
+
   return (
     <>
       <EuiSpacer size={'m'} />
@@ -323,27 +330,60 @@ export const Expressions: React.FC<Props> = (props) => {
       </div>
 
       <EuiSpacer size={'m'} />
-      <EuiCheckbox
-        id="metrics-alert-no-data-toggle"
-        label={
-          <>
-            {i18n.translate('xpack.infra.metrics.alertFlyout.alertOnNoData', {
-              defaultMessage: "Alert me if there's no data",
-            })}{' '}
-            <EuiToolTip
-              content={i18n.translate('xpack.infra.metrics.alertFlyout.noDataHelpText', {
-                defaultMessage:
-                  'Enable this to trigger the action if the metric(s) do not report any data over the expected time period, or if the alert fails to query Elasticsearch',
-              })}
-            >
-              <EuiIcon type="questionInCircle" color="subdued" />
-            </EuiToolTip>
-          </>
-        }
-        checked={alertParams.alertOnNoData}
-        onChange={(e) => setAlertParams('alertOnNoData', e.target.checked)}
-      />
-
+      <EuiAccordion
+        id="advanced-options-accordion"
+        buttonContent={i18n.translate('xpack.infra.metrics.alertFlyout.advancedOptions', {
+          defaultMessage: 'Advanced options',
+        })}
+      >
+        <EuiPanel color="subdued">
+          <EuiCheckbox
+            id="metrics-alert-no-data-toggle"
+            label={
+              <>
+                {i18n.translate('xpack.infra.metrics.alertFlyout.alertOnNoData', {
+                  defaultMessage: "Alert me if there's no data",
+                })}{' '}
+                <EuiToolTip
+                  content={i18n.translate('xpack.infra.metrics.alertFlyout.noDataHelpText', {
+                    defaultMessage:
+                      'Enable this to trigger the action if the metric(s) do not report any data over the expected time period, or if the alert fails to query Elasticsearch',
+                  })}
+                >
+                  <EuiIcon type="questionInCircle" color="subdued" />
+                </EuiToolTip>
+              </>
+            }
+            checked={alertParams.alertOnNoData}
+            onChange={(e) => setAlertParams('alertOnNoData', e.target.checked)}
+          />
+          <EuiCheckbox
+            id="metrics-alert-partial-buckets-toggle"
+            label={
+              <>
+                {i18n.translate('xpack.infra.metrics.alertFlyout.shouldDropPartialBuckets', {
+                  defaultMessage: 'Drop partial buckets when evaluating data',
+                })}{' '}
+                <EuiToolTip
+                  content={i18n.translate(
+                    'xpack.infra.metrics.alertFlyout.dropPartialBucketsHelpText',
+                    {
+                      defaultMessage:
+                        "Enable this to drop the most recent bucket of evaluation data if it's less than {timeSize}{timeUnit}.",
+                      values: { timeSize, timeUnit },
+                    }
+                  )}
+                >
+                  <EuiIcon type="questionInCircle" color="subdued" />
+                </EuiToolTip>
+              </>
+            }
+            checked={areAllAggsRate || alertParams.shouldDropPartialBuckets}
+            disabled={areAllAggsRate}
+            onChange={(e) => setAlertParams('shouldDropPartialBuckets', e.target.checked)}
+          />
+        </EuiPanel>
+      </EuiAccordion>
       <EuiSpacer size={'m'} />
 
       <EuiFormRow
@@ -400,7 +440,14 @@ export const Expressions: React.FC<Props> = (props) => {
         alertThrottle={alertThrottle}
         alertNotifyWhen={alertNotifyWhen}
         alertType={METRIC_THRESHOLD_ALERT_TYPE_ID}
-        alertParams={pick(alertParams, 'criteria', 'groupBy', 'filterQuery', 'sourceId')}
+        alertParams={pick(
+          alertParams,
+          'criteria',
+          'groupBy',
+          'filterQuery',
+          'sourceId',
+          'shouldDropPartialBuckets'
+        )}
         showNoDataResults={alertParams.alertOnNoData}
         validate={validateMetricThreshold}
         groupByDisplayName={groupByPreviewDisplayName}
diff --git a/x-pack/plugins/infra/public/alerting/metric_threshold/types.ts b/x-pack/plugins/infra/public/alerting/metric_threshold/types.ts
index fca4160199030b..a679579e57235a 100644
--- a/x-pack/plugins/infra/public/alerting/metric_threshold/types.ts
+++ b/x-pack/plugins/infra/public/alerting/metric_threshold/types.ts
@@ -61,4 +61,5 @@ export interface AlertParams {
   sourceId: string;
   filterQueryText?: string;
   alertOnNoData?: boolean;
+  shouldDropPartialBuckets?: boolean;
 }
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/evaluate_alert.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/evaluate_alert.ts
index d3fa983ff9e841..6d99b6e2f5fe30 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/evaluate_alert.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/evaluate_alert.ts
@@ -45,6 +45,7 @@ export interface EvaluatedAlertParams {
   criteria: MetricExpressionParams[];
   groupBy: string | undefined | string[];
   filterQuery: string | undefined;
+  shouldDropPartialBuckets?: boolean;
 }
 
 export const evaluateAlert = <Params extends EvaluatedAlertParams = EvaluatedAlertParams>(
@@ -53,7 +54,7 @@ export const evaluateAlert = <Params extends EvaluatedAlertParams = EvaluatedAle
   config: InfraSource['configuration'],
   timeframe?: { start: number; end: number }
 ) => {
-  const { criteria, groupBy, filterQuery } = params;
+  const { criteria, groupBy, filterQuery, shouldDropPartialBuckets } = params;
   return Promise.all(
     criteria.map(async (criterion) => {
       const currentValues = await getMetric(
@@ -63,7 +64,8 @@ export const evaluateAlert = <Params extends EvaluatedAlertParams = EvaluatedAle
         config.fields.timestamp,
         groupBy,
         filterQuery,
-        timeframe
+        timeframe,
+        shouldDropPartialBuckets
       );
 
       const { threshold, warningThreshold, comparator, warningComparator } = criterion;
@@ -96,8 +98,6 @@ export const evaluateAlert = <Params extends EvaluatedAlertParams = EvaluatedAle
   );
 };
 
-const MINIMUM_BUCKETS = 5;
-
 const getMetric: (
   esClient: ElasticsearchClient,
   params: MetricExpressionParams,
@@ -105,7 +105,8 @@ const getMetric: (
   timefield: string,
   groupBy: string | undefined | string[],
   filterQuery: string | undefined,
-  timeframe?: { start: number; end: number }
+  timeframe?: { start: number; end: number },
+  shouldDropPartialBuckets?: boolean
 ) => Promise<Record<string, number[]>> = async function (
   esClient,
   params,
@@ -113,7 +114,8 @@ const getMetric: (
   timefield,
   groupBy,
   filterQuery,
-  timeframe
+  timeframe,
+  shouldDropPartialBuckets
 ) {
   const { aggType, timeSize, timeUnit } = params;
   const hasGroupBy = groupBy && groupBy.length;
@@ -127,10 +129,10 @@ const getMetric: (
     .startOf(timeUnit)
     .valueOf();
 
-  // We need enough data for 5 buckets worth of data. We also need
-  // to convert the intervalAsSeconds to milliseconds.
-  // TODO: We only need to get 5 buckets for the rate query, so this logic should move there.
-  const minimumFrom = to - intervalAsMS * MINIMUM_BUCKETS;
+  // Rate aggregations need 5 buckets worth of data
+  const minimumBuckets = aggType === Aggregators.RATE ? 5 : 1;
+
+  const minimumFrom = to - intervalAsMS * minimumBuckets;
 
   const from = roundTimestamp(
     timeframe && timeframe.start <= minimumFrom ? timeframe.start : minimumFrom,
@@ -145,6 +147,16 @@ const getMetric: (
     filterQuery
   );
 
+  const dropPartialBucketsOptions =
+    // Rate aggs always drop partial buckets; guard against this boolean being passed as false
+    shouldDropPartialBuckets || aggType === Aggregators.RATE
+      ? {
+          from,
+          to,
+          bucketSizeInMillis: intervalAsMS,
+        }
+      : null;
+
   try {
     if (hasGroupBy) {
       const bucketSelector = (
@@ -166,11 +178,7 @@ const getMetric: (
           ...result,
           [Object.values(bucket.key)
             .map((value) => value)
-            .join(', ')]: getValuesFromAggregations(bucket, aggType, {
-            from,
-            to,
-            bucketSizeInMillis: intervalAsMS,
-          }),
+            .join(', ')]: getValuesFromAggregations(bucket, aggType, dropPartialBucketsOptions),
         }),
         {}
       );
@@ -184,7 +192,7 @@ const getMetric: (
       [UNGROUPED_FACTORY_KEY]: getValuesFromAggregations(
         (result.aggregations! as unknown) as Aggregation,
         aggType,
-        { from, to, bucketSizeInMillis: intervalAsMS }
+        dropPartialBucketsOptions
       ),
     };
   } catch (e) {
@@ -224,47 +232,46 @@ const dropPartialBuckets = ({ from, to, bucketSizeInMillis }: DropPartialBucketO
 const getValuesFromAggregations = (
   aggregations: Aggregation,
   aggType: MetricExpressionParams['aggType'],
-  dropPartialBucketsOptions: DropPartialBucketOptions
+  dropPartialBucketsOptions: DropPartialBucketOptions | null
 ) => {
   try {
     const { buckets } = aggregations.aggregatedIntervals;
     if (!buckets.length) return null; // No Data state
 
+    let mappedBuckets;
+
     if (aggType === Aggregators.COUNT) {
-      return buckets.map((bucket) => ({
+      mappedBuckets = buckets.map((bucket) => ({
         key: bucket.from_as_string,
         value: bucket.doc_count,
       }));
-    }
-    if (aggType === Aggregators.P95 || aggType === Aggregators.P99) {
-      return buckets.map((bucket) => {
+    } else if (aggType === Aggregators.P95 || aggType === Aggregators.P99) {
+      mappedBuckets = buckets.map((bucket) => {
         const values = bucket.aggregatedValue?.values || [];
         const firstValue = first(values);
         if (!firstValue) return null;
         return { key: bucket.from_as_string, value: firstValue.value };
       });
-    }
-
-    if (aggType === Aggregators.AVERAGE) {
-      return buckets.map((bucket) => ({
+    } else if (aggType === Aggregators.AVERAGE) {
+      mappedBuckets = buckets.map((bucket) => ({
+        key: bucket.key_as_string ?? bucket.from_as_string,
+        value: bucket.aggregatedValue?.value ?? null,
+      }));
+    } else if (aggType === Aggregators.RATE) {
+      mappedBuckets = buckets.map((bucket) => ({
+        key: bucket.key_as_string ?? bucket.from_as_string,
+        value: bucket.aggregatedValue?.value ?? null,
+      }));
+    } else {
+      mappedBuckets = buckets.map((bucket) => ({
         key: bucket.key_as_string ?? bucket.from_as_string,
         value: bucket.aggregatedValue?.value ?? null,
       }));
     }
-
-    if (aggType === Aggregators.RATE) {
-      return buckets
-        .map((bucket) => ({
-          key: bucket.key_as_string ?? bucket.from_as_string,
-          value: bucket.aggregatedValue?.value ?? null,
-        }))
-        .filter(dropPartialBuckets(dropPartialBucketsOptions));
+    if (dropPartialBucketsOptions) {
+      return mappedBuckets.filter(dropPartialBuckets(dropPartialBucketsOptions));
     }
-
-    return buckets.map((bucket) => ({
-      key: bucket.key_as_string ?? bucket.from_as_string,
-      value: bucket.aggregatedValue?.value ?? null,
-    }));
+    return mappedBuckets;
   } catch (e) {
     return NaN; // Error state
   }
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.test.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.test.ts
index 2ba8365d6b4a91..dd29437275243d 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.test.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.test.ts
@@ -64,4 +64,30 @@ describe("The Metric Threshold Alert's getElasticsearchMetricQuery", () => {
       );
     });
   });
+
+  describe('when passed a timeframe of 1 hour', () => {
+    const testTimeframe = {
+      start: moment().subtract(1, 'hour').valueOf(),
+      end: moment().valueOf(),
+    };
+    const searchBodyWithoutGroupBy = getElasticsearchMetricQuery(
+      expressionParams,
+      timefield,
+      testTimeframe
+    );
+    const searchBodyWithGroupBy = getElasticsearchMetricQuery(
+      expressionParams,
+      timefield,
+      testTimeframe,
+      groupBy
+    );
+    test("generates 1 hour's worth of buckets", () => {
+      // @ts-ignore
+      expect(searchBodyWithoutGroupBy.aggs.aggregatedIntervals.date_range.ranges.length).toBe(60);
+      expect(
+        // @ts-ignore
+        searchBodyWithGroupBy.aggs.groupings.aggs.aggregatedIntervals.date_range.ranges.length
+      ).toBe(60);
+    });
+  });
 });
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.ts
index cde84b217be950..66e112640c3576 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.ts
@@ -76,12 +76,13 @@ export const getElasticsearchMetricQuery = (
           aggregatedIntervals: {
             date_range: {
               field: timefield,
-              ranges: [
-                {
-                  from: to - intervalAsMS - deliveryDelay,
-                  to: to - deliveryDelay,
-                },
-              ],
+              // Generate an array of buckets, starting at `from` and ending at `to`
+              // This is usually only necessary for alert previews or rate aggs. Most alert evaluations
+              // will generate only one bucket from this logic.
+              ranges: Array.from(Array(Math.floor((to - from) / intervalAsMS)), (_, i) => ({
+                from: from + intervalAsMS * i - deliveryDelay,
+                to: from + intervalAsMS * (i + 1) - deliveryDelay,
+              })),
             },
             aggregations,
           },
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/preview_metric_threshold_alert.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/preview_metric_threshold_alert.ts
index a4c207f4006d56..931b830875cdfa 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/preview_metric_threshold_alert.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/preview_metric_threshold_alert.ts
@@ -26,6 +26,7 @@ interface PreviewMetricThresholdAlertParams {
     criteria: MetricExpressionParams[];
     groupBy: string | undefined | string[];
     filterQuery: string | undefined;
+    shouldDropPartialBuckets?: boolean;
   };
   config: InfraSource['configuration'];
   lookback: Unit;
diff --git a/x-pack/plugins/lens/common/expressions/datatable/sorting.test.tsx b/x-pack/plugins/lens/common/expressions/datatable/sorting.test.tsx
index f5d457db652341..b5ff0a7e6915b3 100644
--- a/x-pack/plugins/lens/common/expressions/datatable/sorting.test.tsx
+++ b/x-pack/plugins/lens/common/expressions/datatable/sorting.test.tsx
@@ -6,7 +6,7 @@
  */
 
 import { getSortingCriteria } from './sorting';
-import { FieldFormat } from 'src/plugins/data/public';
+import type { FieldFormat } from 'src/plugins/field_formats/common';
 import { DatatableColumnType } from 'src/plugins/expressions';
 
 function getMockFormatter() {
diff --git a/x-pack/plugins/lens/common/expressions/datatable/sorting.tsx b/x-pack/plugins/lens/common/expressions/datatable/sorting.tsx
index 13ca811b0b0823..30060c10ea37e5 100644
--- a/x-pack/plugins/lens/common/expressions/datatable/sorting.tsx
+++ b/x-pack/plugins/lens/common/expressions/datatable/sorting.tsx
@@ -7,7 +7,7 @@
 
 import ipaddr from 'ipaddr.js';
 import type { IPv4, IPv6 } from 'ipaddr.js';
-import type { FieldFormat } from '../../../../../../src/plugins/data/common';
+import type { FieldFormat } from '../../../../../../src/plugins/field_formats/common';
 
 function isIPv6Address(ip: IPv4 | IPv6): ip is IPv6 {
   return ip.kind() === 'ipv6';
diff --git a/x-pack/plugins/lens/common/expressions/datatable/summary.test.ts b/x-pack/plugins/lens/common/expressions/datatable/summary.test.ts
index 9f8f56cc927683..61e74e0ef3bc7c 100644
--- a/x-pack/plugins/lens/common/expressions/datatable/summary.test.ts
+++ b/x-pack/plugins/lens/common/expressions/datatable/summary.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { IFieldFormat } from 'src/plugins/data/common';
+import type { IFieldFormat } from 'src/plugins/field_formats/common';
 import { Datatable } from 'src/plugins/expressions';
 import { computeSummaryRowForColumn, getFinalSummaryConfiguration } from './summary';
 
diff --git a/x-pack/plugins/lens/common/expressions/datatable/summary.ts b/x-pack/plugins/lens/common/expressions/datatable/summary.ts
index aceade2a3a5139..76c607ca4c4ee9 100644
--- a/x-pack/plugins/lens/common/expressions/datatable/summary.ts
+++ b/x-pack/plugins/lens/common/expressions/datatable/summary.ts
@@ -6,7 +6,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import type { FieldFormat } from '../../../../../../src/plugins/data/common';
+import type { FieldFormat } from '../../../../../../src/plugins/field_formats/common';
 import type { Datatable } from '../../../../../../src/plugins/expressions/common';
 import { ColumnConfigArg } from './datatable_column';
 import { getOriginalId } from './transpose_helpers';
diff --git a/x-pack/plugins/lens/common/expressions/datatable/transpose_helpers.test.ts b/x-pack/plugins/lens/common/expressions/datatable/transpose_helpers.test.ts
index 7ac6b3d987c842..6adb8b59474db8 100644
--- a/x-pack/plugins/lens/common/expressions/datatable/transpose_helpers.test.ts
+++ b/x-pack/plugins/lens/common/expressions/datatable/transpose_helpers.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { FieldFormat } from 'src/plugins/data/public';
+import type { FieldFormat } from 'src/plugins/field_formats/common';
 import type { Datatable } from 'src/plugins/expressions';
 import { DatatableArgs } from './datatable';
 
diff --git a/x-pack/plugins/lens/common/expressions/datatable/transpose_helpers.ts b/x-pack/plugins/lens/common/expressions/datatable/transpose_helpers.ts
index 06798413c8f40e..e2d928fda24ed1 100644
--- a/x-pack/plugins/lens/common/expressions/datatable/transpose_helpers.ts
+++ b/x-pack/plugins/lens/common/expressions/datatable/transpose_helpers.ts
@@ -10,7 +10,7 @@ import type {
   DatatableColumn,
   DatatableRow,
 } from '../../../../../../src/plugins/expressions';
-import type { FieldFormat } from '../../../../../../src/plugins/data/common';
+import type { FieldFormat } from '../../../../../../src/plugins/field_formats/common';
 import type { DatatableArgs } from './datatable';
 import type { ColumnConfig, ColumnConfigArg } from './datatable_column';
 
diff --git a/x-pack/plugins/lens/common/suffix_formatter/index.ts b/x-pack/plugins/lens/common/suffix_formatter/index.ts
index 97fa8c067331e8..00ae005c38b148 100644
--- a/x-pack/plugins/lens/common/suffix_formatter/index.ts
+++ b/x-pack/plugins/lens/common/suffix_formatter/index.ts
@@ -6,11 +6,11 @@
  */
 
 import { i18n } from '@kbn/i18n';
+import { KBN_FIELD_TYPES } from '@kbn/field-types';
 import {
   FieldFormat,
   FieldFormatInstanceType,
-  KBN_FIELD_TYPES,
-} from '../../../../../src/plugins/data/common';
+} from '../../../../../src/plugins/field_formats/common';
 import type { FormatFactory } from '../types';
 import type { TimeScaleUnit } from '../expressions/time_scale';
 
diff --git a/x-pack/plugins/lens/common/types.ts b/x-pack/plugins/lens/common/types.ts
index a60061a3aa054b..06fa31b87ce640 100644
--- a/x-pack/plugins/lens/common/types.ts
+++ b/x-pack/plugins/lens/common/types.ts
@@ -5,7 +5,8 @@
  * 2.0.
  */
 
-import type { FilterMeta, Filter, IFieldFormat } from '../../../../src/plugins/data/common';
+import type { FilterMeta, Filter } from '../../../../src/plugins/data/common';
+import type { IFieldFormat } from '../../../../src/plugins/field_formats/common';
 import type { Datatable, SerializedFieldFormat } from '../../../../src/plugins/expressions/common';
 
 export type FormatFactory = (mapping?: SerializedFieldFormat) => IFieldFormat;
diff --git a/x-pack/plugins/lens/kibana.json b/x-pack/plugins/lens/kibana.json
index fd394aea90d668..6a3e0f40c48f4a 100644
--- a/x-pack/plugins/lens/kibana.json
+++ b/x-pack/plugins/lens/kibana.json
@@ -36,7 +36,8 @@
     "savedObjects",
     "kibanaUtils",
     "kibanaReact",
-    "embeddable"
+    "embeddable",
+    "fieldFormats"
   ],
   "owner": {
     "name": "Kibana App",
diff --git a/x-pack/plugins/lens/public/datatable_visualization/components/cell_value.test.tsx b/x-pack/plugins/lens/public/datatable_visualization/components/cell_value.test.tsx
index fb9cb992fcf47d..96413444d60c46 100644
--- a/x-pack/plugins/lens/public/datatable_visualization/components/cell_value.test.tsx
+++ b/x-pack/plugins/lens/public/datatable_visualization/components/cell_value.test.tsx
@@ -9,7 +9,7 @@ import { mountWithIntl } from '@kbn/test/jest';
 import React from 'react';
 import { DataContext } from './table_basic';
 import { createGridCell } from './cell_value';
-import { FieldFormat } from 'src/plugins/data/public';
+import type { FieldFormat } from 'src/plugins/field_formats/common';
 import { Datatable } from 'src/plugins/expressions/public';
 import { IUiSettingsClient } from 'kibana/public';
 import { act } from 'react-dom/test-utils';
diff --git a/x-pack/plugins/lens/public/datatable_visualization/components/table_basic.test.tsx b/x-pack/plugins/lens/public/datatable_visualization/components/table_basic.test.tsx
index bb678a361e1741..a0d137b90e84c5 100644
--- a/x-pack/plugins/lens/public/datatable_visualization/components/table_basic.test.tsx
+++ b/x-pack/plugins/lens/public/datatable_visualization/components/table_basic.test.tsx
@@ -10,7 +10,8 @@ import { ReactWrapper, shallow } from 'enzyme';
 import { act } from 'react-dom/test-utils';
 import { mountWithIntl } from '@kbn/test/jest';
 import { EuiDataGrid } from '@elastic/eui';
-import { IAggType, IFieldFormat } from 'src/plugins/data/public';
+import { IAggType } from 'src/plugins/data/public';
+import { IFieldFormat } from 'src/plugins/field_formats/common';
 import { VisualizationContainer } from '../../visualization_container';
 import { EmptyPlaceholder } from '../../shared_components';
 import { LensIconChartDatatable } from '../../assets/chart_datatable';
diff --git a/x-pack/plugins/lens/public/datatable_visualization/expression.test.tsx b/x-pack/plugins/lens/public/datatable_visualization/expression.test.tsx
index 4b4d2275d0dec0..163971c4ba9fb3 100644
--- a/x-pack/plugins/lens/public/datatable_visualization/expression.test.tsx
+++ b/x-pack/plugins/lens/public/datatable_visualization/expression.test.tsx
@@ -8,7 +8,7 @@
 import { DatatableProps } from '../../common/expressions';
 import type { LensMultiTable } from '../../common';
 import { createMockExecutionContext } from '../../../../../src/plugins/expressions/common/mocks';
-import { IFieldFormat } from '../../../../../src/plugins/data/public';
+import type { IFieldFormat } from '../../../../../src/plugins/field_formats/common';
 import { getDatatable } from './expression';
 
 function sampleArgs() {
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/ranges/advanced_editor.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/ranges/advanced_editor.tsx
index 43f5527e42d4bf..84bcb48f95234d 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/ranges/advanced_editor.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/ranges/advanced_editor.tsx
@@ -23,7 +23,7 @@ import {
   keys,
 } from '@elastic/eui';
 import { useDebounceWithOptions } from '../../../../shared_components';
-import { IFieldFormat } from '../../../../../../../../src/plugins/data/common';
+import { IFieldFormat } from '../../../../../../../../src/plugins/field_formats/common';
 import { RangeTypeLens, isValidRange } from './ranges';
 import { FROM_PLACEHOLDER, TO_PLACEHOLDER, TYPING_DEBOUNCE_TIME } from './constants';
 import {
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/ranges/range_editor.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/ranges/range_editor.tsx
index 3389c723b4daf6..69460c649c3e1c 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/ranges/range_editor.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/ranges/range_editor.tsx
@@ -18,7 +18,7 @@ import {
   EuiRange,
   EuiToolTip,
 } from '@elastic/eui';
-import type { IFieldFormat } from 'src/plugins/data/public';
+import type { IFieldFormat } from 'src/plugins/field_formats/common';
 import { UI_SETTINGS } from '../../../../../../../../src/plugins/data/public';
 import { RangeColumnParams, UpdateParamsFnType, MODES_TYPES } from './ranges';
 import { AdvancedRangeEditor } from './advanced_editor';
@@ -59,7 +59,7 @@ const GranularityHelpPopover = () => {
       <p>
         <FormattedMessage
           id="xpack.lens.indexPattern.ranges.granularityPopoverExplanation"
-          defaultMessage='The size of the interval is a "nice" value. When the granularity of the slider changes, the interval stays the same when the “nice” interval is the same. The minimum granularity is 1, and the maximum value is 
+          defaultMessage='The size of the interval is a "nice" value. When the granularity of the slider changes, the interval stays the same when the “nice” interval is the same. The minimum granularity is 1, and the maximum value is
             {setting}. To change the maximum granularity, go to Advanced settings.'
           values={{
             setting: <EuiCode>{UI_SETTINGS.HISTOGRAM_MAX_BARS}</EuiCode>,
diff --git a/x-pack/plugins/lens/public/metric_visualization/expression.test.tsx b/x-pack/plugins/lens/public/metric_visualization/expression.test.tsx
index 21c68a9fe1d826..10575f37dba6e0 100644
--- a/x-pack/plugins/lens/public/metric_visualization/expression.test.tsx
+++ b/x-pack/plugins/lens/public/metric_visualization/expression.test.tsx
@@ -10,7 +10,7 @@ import { MetricConfig } from '../../common/expressions';
 import React from 'react';
 import { shallow } from 'enzyme';
 import { createMockExecutionContext } from '../../../../../src/plugins/expressions/common/mocks';
-import { IFieldFormat } from '../../../../../src/plugins/data/public';
+import type { IFieldFormat } from '../../../../../src/plugins/field_formats/common';
 import type { LensMultiTable } from '../../common';
 
 function sampleArgs() {
diff --git a/x-pack/plugins/lens/public/xy_visualization/__snapshots__/expression.test.tsx.snap b/x-pack/plugins/lens/public/xy_visualization/__snapshots__/expression.test.tsx.snap
index c17eeec91dc2b6..cf5ca5c9c0c002 100644
--- a/x-pack/plugins/lens/public/xy_visualization/__snapshots__/expression.test.tsx.snap
+++ b/x-pack/plugins/lens/public/xy_visualization/__snapshots__/expression.test.tsx.snap
@@ -17,6 +17,7 @@ exports[`xy_expression XYChart component it renders area 1`] = `
     legendPosition="top"
     onBrushEnd={[Function]}
     onElementClick={[Function]}
+    onPointerUpdate={[Function]}
     rotation={0}
     showLegend={false}
     showLegendExtra={false}
@@ -234,6 +235,7 @@ exports[`xy_expression XYChart component it renders bar 1`] = `
     legendPosition="top"
     onBrushEnd={[Function]}
     onElementClick={[Function]}
+    onPointerUpdate={[Function]}
     rotation={0}
     showLegend={false}
     showLegendExtra={false}
@@ -465,6 +467,7 @@ exports[`xy_expression XYChart component it renders horizontal bar 1`] = `
     legendPosition="top"
     onBrushEnd={[Function]}
     onElementClick={[Function]}
+    onPointerUpdate={[Function]}
     rotation={90}
     showLegend={false}
     showLegendExtra={false}
@@ -696,6 +699,7 @@ exports[`xy_expression XYChart component it renders line 1`] = `
     legendPosition="top"
     onBrushEnd={[Function]}
     onElementClick={[Function]}
+    onPointerUpdate={[Function]}
     rotation={0}
     showLegend={false}
     showLegendExtra={false}
@@ -913,6 +917,7 @@ exports[`xy_expression XYChart component it renders stacked area 1`] = `
     legendPosition="top"
     onBrushEnd={[Function]}
     onElementClick={[Function]}
+    onPointerUpdate={[Function]}
     rotation={0}
     showLegend={false}
     showLegendExtra={false}
@@ -1138,6 +1143,7 @@ exports[`xy_expression XYChart component it renders stacked bar 1`] = `
     legendPosition="top"
     onBrushEnd={[Function]}
     onElementClick={[Function]}
+    onPointerUpdate={[Function]}
     rotation={0}
     showLegend={false}
     showLegendExtra={false}
@@ -1377,6 +1383,7 @@ exports[`xy_expression XYChart component it renders stacked horizontal bar 1`] =
     legendPosition="top"
     onBrushEnd={[Function]}
     onElementClick={[Function]}
+    onPointerUpdate={[Function]}
     rotation={90}
     showLegend={false}
     showLegendExtra={false}
diff --git a/x-pack/plugins/lens/public/xy_visualization/axes_configuration.ts b/x-pack/plugins/lens/public/xy_visualization/axes_configuration.ts
index 83d86eb410b195..95c9140624e63e 100644
--- a/x-pack/plugins/lens/public/xy_visualization/axes_configuration.ts
+++ b/x-pack/plugins/lens/public/xy_visualization/axes_configuration.ts
@@ -8,7 +8,7 @@
 import { FormatFactory } from '../../common';
 import { AxisExtentConfig, XYLayerConfig } from '../../common/expressions';
 import { Datatable, SerializedFieldFormat } from '../../../../../src/plugins/expressions/public';
-import { IFieldFormat } from '../../../../../src/plugins/data/public';
+import type { IFieldFormat } from '../../../../../src/plugins/field_formats/common';
 
 interface FormattedMetric {
   layer: string;
diff --git a/x-pack/plugins/lens/public/xy_visualization/expression.test.tsx b/x-pack/plugins/lens/public/xy_visualization/expression.test.tsx
index 56a59bd7713b2e..94ed5037000422 100644
--- a/x-pack/plugins/lens/public/xy_visualization/expression.test.tsx
+++ b/x-pack/plugins/lens/public/xy_visualization/expression.test.tsx
@@ -49,7 +49,12 @@ import { XyEndzones } from './x_domain';
 const onClickValue = jest.fn();
 const onSelectRange = jest.fn();
 
-const chartsThemeService = chartPluginMock.createSetupContract().theme;
+const chartSetupContract = chartPluginMock.createSetupContract();
+const chartStartContract = chartPluginMock.createStartContract();
+
+const chartsThemeService = chartSetupContract.theme;
+const chartsActiveCursorService = chartStartContract.activeCursor;
+
 const paletteService = chartPluginMock.createPaletteRegistry();
 
 const mockPaletteOutput: PaletteOutput = {
@@ -473,6 +478,7 @@ describe('xy_expression', () => {
         timeZone: 'UTC',
         renderMode: 'display',
         chartsThemeService,
+        chartsActiveCursorService,
         paletteService,
         minInterval: 50,
         onClickValue,
diff --git a/x-pack/plugins/lens/public/xy_visualization/expression.tsx b/x-pack/plugins/lens/public/xy_visualization/expression.tsx
index b7f22ebf8968d7..23b251b76e9504 100644
--- a/x-pack/plugins/lens/public/xy_visualization/expression.tsx
+++ b/x-pack/plugins/lens/public/xy_visualization/expression.tsx
@@ -7,7 +7,7 @@
 
 import './expression.scss';
 
-import React, { useState, useEffect } from 'react';
+import React, { useState, useEffect, useRef } from 'react';
 import ReactDOM from 'react-dom';
 import {
   Chart,
@@ -47,8 +47,10 @@ import { isHorizontalChart, getSeriesColor } from './state_helpers';
 import { search } from '../../../../../src/plugins/data/public';
 import {
   ChartsPluginSetup,
+  ChartsPluginStart,
   PaletteRegistry,
   SeriesLayer,
+  useActiveCursor,
 } from '../../../../../src/plugins/charts/public';
 import { EmptyPlaceholder } from '../shared_components';
 import { getFitOptions } from './fitting_functions';
@@ -85,6 +87,7 @@ export {
 
 export type XYChartRenderProps = XYChartProps & {
   chartsThemeService: ChartsPluginSetup['theme'];
+  chartsActiveCursorService: ChartsPluginStart['activeCursor'];
   paletteService: PaletteRegistry;
   formatFactory: FormatFactory;
   timeZone: string;
@@ -121,7 +124,8 @@ export function calculateMinInterval({ args: { layers }, data }: XYChartProps) {
 
 export const getXyChartRenderer = (dependencies: {
   formatFactory: Promise<FormatFactory>;
-  chartsThemeService: ChartsPluginSetup['theme'];
+  chartsThemeService: ChartsPluginStart['theme'];
+  chartsActiveCursorService: ChartsPluginStart['activeCursor'];
   paletteService: PaletteRegistry;
   timeZone: string;
 }): ExpressionRenderDefinition<XYChartProps> => ({
@@ -150,6 +154,7 @@ export const getXyChartRenderer = (dependencies: {
         <XYChartReportable
           {...config}
           formatFactory={formatFactory}
+          chartsActiveCursorService={dependencies.chartsActiveCursorService}
           chartsThemeService={dependencies.chartsThemeService}
           paletteService={dependencies.paletteService}
           timeZone={dependencies.timeZone}
@@ -222,6 +227,7 @@ export function XYChart({
   formatFactory,
   timeZone,
   chartsThemeService,
+  chartsActiveCursorService,
   paletteService,
   minInterval,
   onClickValue,
@@ -240,11 +246,16 @@ export function XYChart({
     yRightExtent,
     valuesInLegend,
   } = args;
+  const chartRef = useRef<Chart>(null);
   const chartTheme = chartsThemeService.useChartsTheme();
   const chartBaseTheme = chartsThemeService.useChartsBaseTheme();
   const darkMode = chartsThemeService.useDarkMode();
   const filteredLayers = getFilteredLayers(layers, data);
 
+  const handleCursorUpdate = useActiveCursor(chartsActiveCursorService, chartRef, {
+    datatables: Object.values(data.tables),
+  });
+
   if (filteredLayers.length === 0) {
     const icon: IconType = layers.length > 0 ? getIconForSeriesType(layers[0].seriesType) : 'bar';
     return <EmptyPlaceholder icon={icon} />;
@@ -486,8 +497,9 @@ export function XYChart({
   } as LegendPositionConfig;
 
   return (
-    <Chart>
+    <Chart ref={chartRef}>
       <Settings
+        onPointerUpdate={handleCursorUpdate}
         debugState={window._echDebugStateFlag ?? false}
         showLegend={
           legend.isVisible && !legend.showSingleSeries
diff --git a/x-pack/plugins/lens/public/xy_visualization/index.ts b/x-pack/plugins/lens/public/xy_visualization/index.ts
index d0f6666f7cd930..61183283ce6400 100644
--- a/x-pack/plugins/lens/public/xy_visualization/index.ts
+++ b/x-pack/plugins/lens/public/xy_visualization/index.ts
@@ -25,7 +25,7 @@ export class XyVisualization {
 
   setup(
     core: CoreSetup<LensPluginStartDependencies, void>,
-    { expressions, formatFactory, editorFrame, charts }: XyVisualizationPluginSetupPlugins
+    { expressions, formatFactory, editorFrame }: XyVisualizationPluginSetupPlugins
   ) {
     editorFrame.registerVisualization(async () => {
       const {
@@ -41,7 +41,7 @@ export class XyVisualization {
         getXyChartRenderer,
         getXyVisualization,
       } = await import('../async_services');
-      const [, { data }] = await core.getStartServices();
+      const [, { data, charts }] = await core.getStartServices();
       const palettes = await charts.palettes.getPalettes();
       expressions.registerFunction(() => legendConfig);
       expressions.registerFunction(() => yAxisConfig);
@@ -57,6 +57,7 @@ export class XyVisualization {
         getXyChartRenderer({
           formatFactory,
           chartsThemeService: charts.theme,
+          chartsActiveCursorService: charts.activeCursor,
           paletteService: palettes,
           timeZone: getTimeZone(core.uiSettings),
         })
diff --git a/x-pack/plugins/lens/tsconfig.json b/x-pack/plugins/lens/tsconfig.json
index 134f0b4185b840..6c4d3631a12f37 100644
--- a/x-pack/plugins/lens/tsconfig.json
+++ b/x-pack/plugins/lens/tsconfig.json
@@ -37,5 +37,6 @@
       { "path": "../../../src/plugins/kibana_react/tsconfig.json" },
       { "path": "../../../src/plugins/embeddable/tsconfig.json"},
       { "path": "../../../src/plugins/presentation_util/tsconfig.json"},
+      { "path": "../../../src/plugins/field_formats/tsconfig.json"}
     ]
-  }
\ No newline at end of file
+  }
diff --git a/x-pack/plugins/license_management/__jest__/__snapshots__/upload_license.test.tsx.snap b/x-pack/plugins/license_management/__jest__/__snapshots__/upload_license.test.tsx.snap
index ea973df9aad765..f81ec6a73d1405 100644
--- a/x-pack/plugins/license_management/__jest__/__snapshots__/upload_license.test.tsx.snap
+++ b/x-pack/plugins/license_management/__jest__/__snapshots__/upload_license.test.tsx.snap
@@ -1408,6 +1408,7 @@ exports[`UploadLicense should display an error when ES says license is expired 1
                                 >
                                   <div
                                     className="euiTextColor euiTextColor--default"
+                                    style={Object {}}
                                   >
                                     <ul>
                                       <li
@@ -2129,6 +2130,7 @@ exports[`UploadLicense should display an error when ES says license is invalid 1
                                 >
                                   <div
                                     className="euiTextColor euiTextColor--default"
+                                    style={Object {}}
                                   >
                                     <ul>
                                       <li
@@ -2850,6 +2852,7 @@ exports[`UploadLicense should display an error when submitting invalid JSON 1`]
                                 >
                                   <div
                                     className="euiTextColor euiTextColor--default"
+                                    style={Object {}}
                                   >
                                     <ul>
                                       <li
@@ -3571,6 +3574,7 @@ exports[`UploadLicense should display error when ES returns error 1`] = `
                                 >
                                   <div
                                     className="euiTextColor euiTextColor--default"
+                                    style={Object {}}
                                   >
                                     <ul>
                                       <li
diff --git a/x-pack/plugins/lists/server/schemas/common/get_shard.mock.ts b/x-pack/plugins/lists/server/schemas/common/get_shard.mock.ts
index cc142157e91a28..43511a748ba1ae 100644
--- a/x-pack/plugins/lists/server/schemas/common/get_shard.mock.ts
+++ b/x-pack/plugins/lists/server/schemas/common/get_shard.mock.ts
@@ -5,9 +5,9 @@
  * 2.0.
  */
 
-import { ShardsResponse } from 'elasticsearch';
+import type { estypes } from '@elastic/elasticsearch';
 
-export const getShardMock = (): ShardsResponse => ({
+export const getShardMock = (): estypes.ShardStatistics => ({
   failed: 0,
   skipped: 0,
   successful: 0,
diff --git a/x-pack/plugins/lists/server/schemas/elastic_response/search_es_list_item_schema.mock.ts b/x-pack/plugins/lists/server/schemas/elastic_response/search_es_list_item_schema.mock.ts
index de49e822f7dc8a..2f213ccfbad06c 100644
--- a/x-pack/plugins/lists/server/schemas/elastic_response/search_es_list_item_schema.mock.ts
+++ b/x-pack/plugins/lists/server/schemas/elastic_response/search_es_list_item_schema.mock.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { SearchResponse } from 'elasticsearch';
+import type { estypes } from '@elastic/elasticsearch';
 
 import {
   DATE_NOW,
@@ -61,7 +61,7 @@ export const getSearchEsListItemMock = (): SearchEsListItemSchema => ({
   ip: VALUE,
 });
 
-export const getSearchListItemMock = (): SearchResponse<SearchEsListItemSchema> => ({
+export const getSearchListItemMock = (): estypes.SearchResponse<SearchEsListItemSchema> => ({
   _scroll_id: '123',
   _shards: getShardMock(),
   hits: {
diff --git a/x-pack/plugins/lists/server/schemas/elastic_response/search_es_list_schema.mock.ts b/x-pack/plugins/lists/server/schemas/elastic_response/search_es_list_schema.mock.ts
index 07d8c92f79932d..2cfbaf26f9d6ae 100644
--- a/x-pack/plugins/lists/server/schemas/elastic_response/search_es_list_schema.mock.ts
+++ b/x-pack/plugins/lists/server/schemas/elastic_response/search_es_list_schema.mock.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { SearchResponse } from 'elasticsearch';
+import type { estypes } from '@elastic/elasticsearch';
 
 import {
   DATE_NOW,
@@ -40,7 +40,7 @@ export const getSearchEsListMock = (): SearchEsListSchema => ({
   version: VERSION,
 });
 
-export const getSearchListMock = (): SearchResponse<SearchEsListSchema> => ({
+export const getSearchListMock = (): estypes.SearchResponse<SearchEsListSchema> => ({
   _scroll_id: '123',
   _shards: getShardMock(),
   hits: {
@@ -60,7 +60,7 @@ export const getSearchListMock = (): SearchResponse<SearchEsListSchema> => ({
   took: 10,
 });
 
-export const getEmptySearchListMock = (): SearchResponse<SearchEsListSchema> => ({
+export const getEmptySearchListMock = (): estypes.SearchResponse<SearchEsListSchema> => ({
   _scroll_id: '123',
   _shards: getShardMock(),
   hits: {
diff --git a/x-pack/plugins/lists/server/services/items/find_list_item.mock.ts b/x-pack/plugins/lists/server/services/items/find_list_item.mock.ts
index c00da8ab2496bc..1c1ce872a402d7 100644
--- a/x-pack/plugins/lists/server/services/items/find_list_item.mock.ts
+++ b/x-pack/plugins/lists/server/services/items/find_list_item.mock.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { Client } from 'elasticsearch';
+import type { estypes } from '@elastic/elasticsearch';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { elasticsearchClientMock } from 'src/core/server/elasticsearch/client/mocks';
 
@@ -14,7 +14,7 @@ import { getShardMock } from '../../schemas/common/get_shard.mock';
 
 import { FindListItemOptions } from './find_list_item';
 
-export const getFindCount = (): ReturnType<Client['count']> => {
+export const getFindCount = (): Promise<estypes.CountResponse> => {
   return Promise.resolve({
     _shards: getShardMock(),
     count: 1,
diff --git a/x-pack/plugins/lists/server/services/items/write_list_items_to_stream.test.ts b/x-pack/plugins/lists/server/services/items/write_list_items_to_stream.test.ts
index e6d0b21ab05173..0918b9ebdedae8 100644
--- a/x-pack/plugins/lists/server/services/items/write_list_items_to_stream.test.ts
+++ b/x-pack/plugins/lists/server/services/items/write_list_items_to_stream.test.ts
@@ -106,7 +106,9 @@ describe('write_list_items_to_stream', () => {
       firstResponse.hits.hits[0].sort = ['some-sort-value'];
 
       const secondResponse = getSearchListItemMock();
-      secondResponse.hits.hits[0]._source.ip = '255.255.255.255';
+      if (secondResponse.hits.hits[0]._source) {
+        secondResponse.hits.hits[0]._source.ip = '255.255.255.255';
+      }
 
       const esClient = elasticsearchClientMock.createScopedClusterClient().asCurrentUser;
       esClient.search.mockResolvedValueOnce(
diff --git a/x-pack/plugins/lists/server/services/utils/transform_elastic_to_list_item.test.ts b/x-pack/plugins/lists/server/services/utils/transform_elastic_to_list_item.test.ts
index 2714d13cb0a26d..e2ec36e533bd1b 100644
--- a/x-pack/plugins/lists/server/services/utils/transform_elastic_to_list_item.test.ts
+++ b/x-pack/plugins/lists/server/services/utils/transform_elastic_to_list_item.test.ts
@@ -37,8 +37,10 @@ describe('transform_elastic_to_list_item', () => {
 
     test('it transforms an elastic keyword type to a list item type', () => {
       const response = getSearchListItemMock();
-      response.hits.hits[0]._source.ip = undefined;
-      response.hits.hits[0]._source.keyword = 'host-name-example';
+      if (response.hits.hits[0]._source) {
+        response.hits.hits[0]._source.ip = undefined;
+        response.hits.hits[0]._source.keyword = 'host-name-example';
+      }
       const queryFilter = transformElasticToListItem({
         response,
         type: 'keyword',
@@ -68,8 +70,10 @@ describe('transform_elastic_to_list_item', () => {
       const {
         hits: { hits },
       } = getSearchListItemMock();
-      hits[0]._source.ip = undefined;
-      hits[0]._source.keyword = 'host-name-example';
+      if (hits[0]._source) {
+        hits[0]._source.ip = undefined;
+        hits[0]._source.keyword = 'host-name-example';
+      }
       const queryFilter = transformElasticHitsToListItem({
         hits,
         type: 'keyword',
diff --git a/x-pack/plugins/ml/common/constants/alerts.ts b/x-pack/plugins/ml/common/constants/alerts.ts
index a801872c5444dc..2192b2b504b59c 100644
--- a/x-pack/plugins/ml/common/constants/alerts.ts
+++ b/x-pack/plugins/ml/common/constants/alerts.ts
@@ -21,26 +21,57 @@ export const TOP_N_BUCKETS_COUNT = 1;
 
 export const ALL_JOBS_SELECTION = '*';
 
-export const HEALTH_CHECK_NAMES: Record<JobsHealthTests, string> = {
-  datafeed: i18n.translate('xpack.ml.alertTypes.jobsHealthAlertingRule.datafeedCheckName', {
-    defaultMessage: 'Datafeed is not started',
-  }),
-  mml: i18n.translate('xpack.ml.alertTypes.jobsHealthAlertingRule.mmlCheckName', {
-    defaultMessage: 'Model memory limit reached',
-  }),
-  errorMessages: i18n.translate(
-    'xpack.ml.alertTypes.jobsHealthAlertingRule.errorMessagesCheckName',
-    {
+export const HEALTH_CHECK_NAMES: Record<JobsHealthTests, { name: string; description: string }> = {
+  datafeed: {
+    name: i18n.translate('xpack.ml.alertTypes.jobsHealthAlertingRule.datafeedCheckName', {
+      defaultMessage: 'Datafeed is not started',
+    }),
+    description: i18n.translate(
+      'xpack.ml.alertTypes.jobsHealthAlertingRule.datafeedCheckDescription',
+      {
+        defaultMessage: 'Get alerted if the corresponding datafeed of the job is not started',
+      }
+    ),
+  },
+  mml: {
+    name: i18n.translate('xpack.ml.alertTypes.jobsHealthAlertingRule.mmlCheckName', {
+      defaultMessage: 'Model memory limit reached',
+    }),
+    description: i18n.translate('xpack.ml.alertTypes.jobsHealthAlertingRule.mmlCheckDescription', {
+      defaultMessage: 'Get alerted when job reaches soft or hard model memory limit.',
+    }),
+  },
+  delayedData: {
+    name: i18n.translate('xpack.ml.alertTypes.jobsHealthAlertingRule.delayedDataCheckName', {
+      defaultMessage: 'Data delay has occurred',
+    }),
+    description: i18n.translate(
+      'xpack.ml.alertTypes.jobsHealthAlertingRule.delayedDataCheckDescription',
+      {
+        defaultMessage: 'Get alerted if a job missed data due to data delay.',
+      }
+    ),
+  },
+  errorMessages: {
+    name: i18n.translate('xpack.ml.alertTypes.jobsHealthAlertingRule.errorMessagesCheckName', {
       defaultMessage: 'There are errors in the job messages',
-    }
-  ),
-  behindRealtime: i18n.translate(
-    'xpack.ml.alertTypes.jobsHealthAlertingRule.behindRealtimeCheckName',
-    {
+    }),
+    description: i18n.translate(
+      'xpack.ml.alertTypes.jobsHealthAlertingRule.errorMessagesCheckDescription',
+      {
+        defaultMessage: 'There are errors in the job messages',
+      }
+    ),
+  },
+  behindRealtime: {
+    name: i18n.translate('xpack.ml.alertTypes.jobsHealthAlertingRule.behindRealtimeCheckName', {
       defaultMessage: 'Job is running behind real-time',
-    }
-  ),
-  delayedData: i18n.translate('xpack.ml.alertTypes.jobsHealthAlertingRule.delayedDataCheckName', {
-    defaultMessage: 'Data delay has occurred',
-  }),
+    }),
+    description: i18n.translate(
+      'xpack.ml.alertTypes.jobsHealthAlertingRule.behindRealtimeCheckDescription',
+      {
+        defaultMessage: 'Job is running behind real-time',
+      }
+    ),
+  },
 };
diff --git a/x-pack/plugins/ml/common/types/alerts.ts b/x-pack/plugins/ml/common/types/alerts.ts
index 877bb2d2933655..408c424f327d55 100644
--- a/x-pack/plugins/ml/common/types/alerts.ts
+++ b/x-pack/plugins/ml/common/types/alerts.ts
@@ -109,7 +109,7 @@ export interface JobAlertingRuleStats {
   alerting_rules?: MlAnomalyDetectionAlertRule[];
 }
 
-interface CommonHealthCheckConfig {
+export interface CommonHealthCheckConfig {
   enabled: boolean;
 }
 
diff --git a/x-pack/plugins/ml/common/types/annotations.ts b/x-pack/plugins/ml/common/types/annotations.ts
index 0417e769e9ed56..6234444322a5bd 100644
--- a/x-pack/plugins/ml/common/types/annotations.ts
+++ b/x-pack/plugins/ml/common/types/annotations.ts
@@ -86,7 +86,12 @@ export interface Annotation {
   annotation: string;
   job_id: string;
   type: ANNOTATION_TYPE.ANNOTATION | ANNOTATION_TYPE.COMMENT;
-  event?: string;
+  event?:
+    | 'user'
+    | 'delayed_data'
+    | 'model_snapshot_stored'
+    | 'model_change'
+    | 'categorization_status_change';
   detector_index?: number;
   partition_field_name?: string;
   partition_field_value?: string;
diff --git a/x-pack/plugins/ml/common/util/alerts.test.ts b/x-pack/plugins/ml/common/util/alerts.test.ts
index dda9fd449467b7..84205e6806133e 100644
--- a/x-pack/plugins/ml/common/util/alerts.test.ts
+++ b/x-pack/plugins/ml/common/util/alerts.test.ts
@@ -90,6 +90,11 @@ describe('getResultJobsHealthRuleConfig', () => {
       mml: {
         enabled: true,
       },
+      delayedData: {
+        docsCount: 1,
+        enabled: true,
+        timeInterval: null,
+      },
     });
   });
   test('returns config with overridden values based on provided configuration', () => {
@@ -97,6 +102,10 @@ describe('getResultJobsHealthRuleConfig', () => {
       getResultJobsHealthRuleConfig({
         mml: { enabled: false },
         errorMessages: { enabled: true },
+        delayedData: {
+          enabled: true,
+          docsCount: 1,
+        },
       })
     ).toEqual({
       datafeed: {
@@ -105,6 +114,11 @@ describe('getResultJobsHealthRuleConfig', () => {
       mml: {
         enabled: false,
       },
+      delayedData: {
+        docsCount: 1,
+        enabled: true,
+        timeInterval: null,
+      },
     });
   });
 });
diff --git a/x-pack/plugins/ml/common/util/alerts.ts b/x-pack/plugins/ml/common/util/alerts.ts
index 86afd70ad74740..7328c2a4dcc711 100644
--- a/x-pack/plugins/ml/common/util/alerts.ts
+++ b/x-pack/plugins/ml/common/util/alerts.ts
@@ -54,7 +54,7 @@ export function getTopNBuckets(job: Job): number {
   return Math.ceil(narrowBucketLength / bucketSpan.asSeconds());
 }
 
-const implementedTests = ['datafeed', 'mml'] as JobsHealthTests[];
+const implementedTests = ['datafeed', 'mml', 'delayedData'] as JobsHealthTests[];
 
 /**
  * Returns tests configuration combined with default values.
@@ -70,6 +70,8 @@ export function getResultJobsHealthRuleConfig(config: JobsHealthRuleTestsConfig)
     },
     delayedData: {
       enabled: config?.delayedData?.enabled ?? true,
+      docsCount: config?.delayedData?.docsCount ?? 1,
+      timeInterval: config?.delayedData?.timeInterval ?? null,
     },
     behindRealtime: {
       enabled: config?.behindRealtime?.enabled ?? true,
diff --git a/x-pack/plugins/ml/kibana.json b/x-pack/plugins/ml/kibana.json
index 7f3ad80968b7a8..1196247fe4629d 100644
--- a/x-pack/plugins/ml/kibana.json
+++ b/x-pack/plugins/ml/kibana.json
@@ -39,7 +39,8 @@
     "savedObjects",
     "home",
     "maps",
-    "usageCollection"
+    "usageCollection",
+    "fieldFormats"
   ],
   "extraPublicDirs": [
     "common"
diff --git a/x-pack/plugins/ml/public/alerting/jobs_health_rule/register_jobs_health_alerting_rule.ts b/x-pack/plugins/ml/public/alerting/jobs_health_rule/register_jobs_health_alerting_rule.ts
index dc4b10102e4f13..f6446b454a8778 100644
--- a/x-pack/plugins/ml/public/alerting/jobs_health_rule/register_jobs_health_alerting_rule.ts
+++ b/x-pack/plugins/ml/public/alerting/jobs_health_rule/register_jobs_health_alerting_rule.ts
@@ -12,6 +12,7 @@ import { PluginSetupContract as AlertingSetup } from '../../../../alerting/publi
 import { ML_ALERT_TYPES } from '../../../common/constants/alerts';
 import { MlAnomalyDetectionJobsHealthRuleParams } from '../../../common/types/alerts';
 import { getResultJobsHealthRuleConfig } from '../../../common/util/alerts';
+import { validateLookbackInterval } from '../validators';
 
 export function registerJobsHealthAlertingRule(
   triggersActionsUi: TriggersAndActionsUIPublicPluginSetup,
@@ -32,6 +33,7 @@ export function registerJobsHealthAlertingRule(
         errors: {
           includeJobs: new Array<string>(),
           testsConfig: new Array<string>(),
+          delayedData: new Array<string>(),
         } as Record<keyof MlAnomalyDetectionJobsHealthRuleParams, string[]>,
       };
 
@@ -53,6 +55,31 @@ export function registerJobsHealthAlertingRule(
         );
       }
 
+      if (
+        !!resultTestConfig.delayedData.timeInterval &&
+        validateLookbackInterval(resultTestConfig.delayedData.timeInterval)
+      ) {
+        validationResult.errors.delayedData.push(
+          i18n.translate(
+            'xpack.ml.alertTypes.jobsHealthAlertingRule.testsConfig.delayedData.timeIntervalErrorMessage',
+            {
+              defaultMessage: 'Invalid time interval',
+            }
+          )
+        );
+      }
+
+      if (resultTestConfig.delayedData.docsCount === 0) {
+        validationResult.errors.delayedData.push(
+          i18n.translate(
+            'xpack.ml.alertTypes.jobsHealthAlertingRule.testsConfig.delayedData.docsCountErrorMessage',
+            {
+              defaultMessage: 'Invalid number of documents',
+            }
+          )
+        );
+      }
+
       return validationResult;
     },
     requiresAppContext: false,
@@ -68,6 +95,9 @@ export function registerJobsHealthAlertingRule(
   \\{\\{#memory_status\\}\\}Memory status: \\{\\{memory_status\\}\\}  \\{\\{/memory_status\\}\\}
   \\{\\{#log_time\\}\\}Memory logging time: \\{\\{log_time\\}\\}  \\{\\{/log_time\\}\\}
   \\{\\{#failed_category_count\\}\\}Failed category count: \\{\\{failed_category_count\\}\\}  \\{\\{/failed_category_count\\}\\}
+  \\{\\{#annotation\\}\\}Annotation: \\{\\{annotation\\}\\}  \\{\\{/annotation\\}\\}
+  \\{\\{#missed_docs_count\\}\\}Number of missed documents: \\{\\{missed_docs_count\\}\\}  \\{\\{/missed_docs_count\\}\\}
+  \\{\\{#end_timestamp\\}\\}Latest finalized bucket with missing docs: \\{\\{end_timestamp\\}\\}  \\{\\{/end_timestamp\\}\\}
 \\{\\{/context.results\\}\\}
 `,
       }
diff --git a/x-pack/plugins/ml/public/alerting/jobs_health_rule/tests_selection_control.tsx b/x-pack/plugins/ml/public/alerting/jobs_health_rule/tests_selection_control.tsx
index 07fbc63346cd44..b78c963670da24 100644
--- a/x-pack/plugins/ml/public/alerting/jobs_health_rule/tests_selection_control.tsx
+++ b/x-pack/plugins/ml/public/alerting/jobs_health_rule/tests_selection_control.tsx
@@ -5,12 +5,22 @@
  * 2.0.
  */
 
-import React, { FC, Fragment, useCallback } from 'react';
-import { i18n } from '@kbn/i18n';
-import { EuiFormFieldset, EuiFormRow, EuiSpacer, EuiSwitch } from '@elastic/eui';
+import React, { FC, useCallback } from 'react';
+import {
+  EuiDescribedFormGroup,
+  EuiFieldNumber,
+  EuiForm,
+  EuiFormRow,
+  EuiIcon,
+  EuiSpacer,
+  EuiSwitch,
+  EuiToolTip,
+} from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
 import { JobsHealthRuleTestsConfig, JobsHealthTests } from '../../../common/types/alerts';
 import { getResultJobsHealthRuleConfig } from '../../../common/util/alerts';
 import { HEALTH_CHECK_NAMES } from '../../../common/constants/alerts';
+import { TimeIntervalControl } from '../time_interval_control';
 
 interface TestsSelectionControlProps {
   config: JobsHealthRuleTestsConfig;
@@ -18,53 +28,127 @@ interface TestsSelectionControlProps {
   errors?: string[];
 }
 
-export const TestsSelectionControl: FC<TestsSelectionControlProps> = ({
-  config,
-  onChange,
-  errors,
-}) => {
-  const uiConfig = getResultJobsHealthRuleConfig(config);
+export const TestsSelectionControl: FC<TestsSelectionControlProps> = React.memo(
+  ({ config, onChange, errors }) => {
+    const uiConfig = getResultJobsHealthRuleConfig(config);
 
-  const updateCallback = useCallback(
-    (update: Partial<Exclude<JobsHealthRuleTestsConfig, undefined>>) => {
-      onChange({
-        ...(config ?? {}),
-        ...update,
-      });
-    },
-    [onChange, config]
-  );
+    const updateCallback = useCallback(
+      (update: Partial<Exclude<JobsHealthRuleTestsConfig, undefined>>) => {
+        onChange({
+          ...(config ?? {}),
+          ...update,
+        });
+      },
+      [onChange, config]
+    );
 
-  return (
-    <EuiFormFieldset
-      legend={{
-        children: i18n.translate(
-          'xpack.ml.alertTypes.jobsHealthAlertingRule.testsSelection.legend',
-          {
-            defaultMessage: 'Select health checks to perform',
-          }
-        ),
-      }}
-    >
-      {Object.entries(uiConfig).map(([name, conf], i) => {
-        return (
-          <Fragment key={name}>
-            <EuiFormRow
-              isInvalid={Object.keys(uiConfig).length === i + 1 && !!errors?.length}
-              error={errors}
+    return (
+      <EuiForm component="div" isInvalid={!!errors?.length} error={errors}>
+        {(Object.entries(uiConfig) as Array<
+          [JobsHealthTests, typeof uiConfig[JobsHealthTests]]
+        >).map(([name, conf], i) => {
+          return (
+            <EuiDescribedFormGroup
+              key={name}
+              title={<h4>{HEALTH_CHECK_NAMES[name]?.name}</h4>}
+              description={HEALTH_CHECK_NAMES[name]?.description}
             >
-              <EuiSwitch
-                label={HEALTH_CHECK_NAMES[name as JobsHealthTests]}
-                onChange={updateCallback.bind(null, {
-                  [name]: { enabled: !uiConfig[name as JobsHealthTests].enabled },
-                })}
-                checked={uiConfig[name as JobsHealthTests].enabled}
-              />
-            </EuiFormRow>
-            <EuiSpacer size="s" />
-          </Fragment>
-        );
-      })}
-    </EuiFormFieldset>
-  );
-};
+              <EuiFormRow>
+                <EuiSwitch
+                  label={
+                    <FormattedMessage
+                      id="xpack.ml.alertTypes.jobsHealthAlertingRule.testsSelection.enableTestLabel"
+                      defaultMessage="Enable"
+                    />
+                  }
+                  onChange={updateCallback.bind(null, {
+                    [name]: {
+                      ...uiConfig[name],
+                      enabled: !uiConfig[name].enabled,
+                    },
+                  })}
+                  checked={uiConfig[name].enabled}
+                />
+              </EuiFormRow>
+              <EuiSpacer size="s" />
+
+              {name === 'delayedData' ? (
+                <>
+                  <EuiFormRow
+                    label={
+                      <>
+                        <FormattedMessage
+                          id="xpack.ml.alertTypes.jobsHealthAlertingRule.testsSelection.delayedData.docsCountLabel"
+                          defaultMessage="Number of documents"
+                        />
+                        <EuiToolTip
+                          position="bottom"
+                          content={
+                            <FormattedMessage
+                              id="xpack.ml.alertTypes.jobsHealthAlertingRule.testsSelection.delayedData.docsCountHint"
+                              defaultMessage="The threshold for the amount of missing documents to alert upon."
+                            />
+                          }
+                        >
+                          <EuiIcon type="questionInCircle" />
+                        </EuiToolTip>
+                      </>
+                    }
+                  >
+                    <EuiFieldNumber
+                      value={uiConfig.delayedData.docsCount}
+                      onChange={(e) => {
+                        updateCallback({
+                          [name]: {
+                            ...uiConfig[name],
+                            docsCount: Number(e.target.value),
+                          },
+                        });
+                      }}
+                      min={1}
+                    />
+                  </EuiFormRow>
+
+                  <EuiSpacer size="s" />
+
+                  <TimeIntervalControl
+                    label={
+                      <>
+                        <FormattedMessage
+                          id="xpack.ml.alertTypes.jobsHealthAlertingRule.testsSelection.delayedData.timeIntervalLabel"
+                          defaultMessage="Time interval"
+                        />
+                        <EuiToolTip
+                          position="bottom"
+                          content={
+                            <FormattedMessage
+                              id="xpack.ml.alertTypes.jobsHealthAlertingRule.testsSelection.delayedData.timeIntervalHint"
+                              defaultMessage="The lookback interval to check during rule execution for delayed data. By default derived from the longest bucket span and query delay."
+                            />
+                          }
+                        >
+                          <EuiIcon type="questionInCircle" />
+                        </EuiToolTip>
+                      </>
+                    }
+                    value={uiConfig.delayedData.timeInterval}
+                    onChange={(e) => {
+                      updateCallback({
+                        [name]: {
+                          ...uiConfig[name],
+                          timeInterval: e,
+                        },
+                      });
+                    }}
+                  />
+
+                  <EuiSpacer size="s" />
+                </>
+              ) : null}
+            </EuiDescribedFormGroup>
+          );
+        })}
+      </EuiForm>
+    );
+  }
+);
diff --git a/x-pack/plugins/ml/public/alerting/time_interval_control.tsx b/x-pack/plugins/ml/public/alerting/time_interval_control.tsx
index 8030d340a37745..4ab73500958ae7 100644
--- a/x-pack/plugins/ml/public/alerting/time_interval_control.tsx
+++ b/x-pack/plugins/ml/public/alerting/time_interval_control.tsx
@@ -27,7 +27,7 @@ export const TimeIntervalControl: FC<TimeIntervalControlProps> = ({
 
   const validationErrors = useMemo(() => validators(value), [value]);
 
-  const isInvalid = value !== undefined && !!validationErrors;
+  const isInvalid = !!value && !!validationErrors;
 
   return (
     <EuiFormRow
diff --git a/x-pack/plugins/ml/public/application/util/time_buckets.js b/x-pack/plugins/ml/public/application/util/time_buckets.js
index 560972ee6c4b8e..d9cfa7729d8d83 100644
--- a/x-pack/plugins/ml/public/application/util/time_buckets.js
+++ b/x-pack/plugins/ml/public/application/util/time_buckets.js
@@ -12,7 +12,8 @@ import dateMath from '@elastic/datemath';
 import { timeBucketsCalcAutoIntervalProvider } from './calc_auto_interval';
 import { parseInterval } from '../../../common/util/parse_interval';
 import { getFieldFormats, getUiSettings } from './dependency_cache';
-import { FIELD_FORMAT_IDS, UI_SETTINGS } from '../../../../../../src/plugins/data/public';
+import { UI_SETTINGS } from '../../../../../../src/plugins/data/public';
+import { FIELD_FORMAT_IDS } from '../../../../../../src/plugins/field_formats/common';
 
 const unitsDesc = dateMath.unitsDesc;
 
diff --git a/x-pack/plugins/ml/server/lib/alerts/jobs_health_service.test.ts b/x-pack/plugins/ml/server/lib/alerts/jobs_health_service.test.ts
index 0d41d5b8cc73e1..b345cf8c1245cb 100644
--- a/x-pack/plugins/ml/server/lib/alerts/jobs_health_service.test.ts
+++ b/x-pack/plugins/ml/server/lib/alerts/jobs_health_service.test.ts
@@ -10,6 +10,9 @@ import type { DatafeedsService } from '../../models/job_service/datafeeds';
 import type { Logger } from 'kibana/server';
 import { MlClient } from '../ml_client';
 import { MlJob, MlJobStats } from '@elastic/elasticsearch/api/types';
+import { AnnotationService } from '../../models/annotation_service/annotation';
+
+const MOCK_DATE_NOW = 1487076708000;
 
 describe('JobsHealthService', () => {
   const mlClient = ({
@@ -20,12 +23,15 @@ describe('JobsHealthService', () => {
         jobs = [
           ({
             job_id: 'test_job_01',
+            analysis_config: { bucket_span: '1h' },
           } as unknown) as MlJob,
           ({
             job_id: 'test_job_02',
+            analysis_config: { bucket_span: '15m' },
           } as unknown) as MlJob,
           ({
             job_id: 'test_job_03',
+            analysis_config: { bucket_span: '8m' },
           } as unknown) as MlJob,
         ];
       }
@@ -34,6 +40,7 @@ describe('JobsHealthService', () => {
         jobs = [
           ({
             job_id: jobIds[0],
+            analysis_config: { bucket_span: '1h' },
           } as unknown) as MlJob,
         ];
       }
@@ -84,13 +91,32 @@ describe('JobsHealthService', () => {
       return Promise.resolve(
         jobIds.map((j) => {
           return {
+            job_id: j,
             datafeed_id: j.replace('job', 'datafeed'),
+            query_delay: '3m',
           };
         })
       );
     }),
   } as unknown) as jest.Mocked<DatafeedsService>;
 
+  const annotationService = ({
+    getDelayedDataAnnotations: jest.fn().mockImplementation(({ jobIds }: { jobIds: string[] }) => {
+      return Promise.resolve(
+        jobIds.map((jobId) => {
+          return {
+            job_id: jobId,
+            annotation: `Datafeed has missed ${
+              jobId === 'test_job_01' ? 11 : 8
+            } documents due to ingest latency, latest bucket with missing data is [2021-07-30T13:50:00.000Z]. Consider increasing query_delay`,
+            modified_time: 1627660295141,
+            end_timestamp: 1627653300000,
+          };
+        })
+      );
+    }),
+  } as unknown) as jest.Mocked<AnnotationService>;
+
   const logger = ({
     warn: jest.fn(),
     info: jest.fn(),
@@ -100,13 +126,19 @@ describe('JobsHealthService', () => {
   const jobHealthService: JobsHealthService = jobsHealthServiceProvider(
     mlClient,
     datafeedsService,
+    annotationService,
     logger
   );
 
-  beforeEach(() => {});
+  let dateNowSpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    dateNowSpy = jest.spyOn(Date, 'now').mockImplementation(() => MOCK_DATE_NOW);
+  });
 
   afterEach(() => {
     jest.clearAllMocks();
+    dateNowSpy.mockRestore();
   });
 
   test('returns empty results when no jobs provided', async () => {
@@ -131,7 +163,11 @@ describe('JobsHealthService', () => {
           enabled: false,
         },
         behindRealtime: null,
-        delayedData: null,
+        delayedData: {
+          enabled: false,
+          docsCount: null,
+          timeInterval: null,
+        },
         errorMessages: null,
         mml: {
           enabled: false,
@@ -149,6 +185,54 @@ describe('JobsHealthService', () => {
     expect(executionResult).toEqual([]);
   });
 
+  test('takes into account delayed data params', async () => {
+    const executionResult = await jobHealthService.getTestsResults('testRule_04', {
+      testsConfig: {
+        delayedData: {
+          enabled: true,
+          docsCount: 10,
+          timeInterval: '4h',
+        },
+        behindRealtime: { enabled: false, timeInterval: null },
+        mml: { enabled: false },
+        datafeed: { enabled: false },
+        errorMessages: { enabled: false },
+      },
+      includeJobs: {
+        jobIds: [],
+        groupIds: ['test_group'],
+      },
+      excludeJobs: {
+        jobIds: ['test_job_03'],
+        groupIds: [],
+      },
+    });
+
+    expect(annotationService.getDelayedDataAnnotations).toHaveBeenCalledWith({
+      jobIds: ['test_job_01', 'test_job_02'],
+      // 1487076708000 - 4h
+      earliestMs: 1487062308000,
+    });
+
+    expect(executionResult).toEqual([
+      {
+        name: 'Data delay has occurred',
+        context: {
+          results: [
+            {
+              job_id: 'test_job_01',
+              annotation:
+                'Datafeed has missed 11 documents due to ingest latency, latest bucket with missing data is [2021-07-30T13:50:00.000Z]. Consider increasing query_delay',
+              end_timestamp: 1627653300000,
+              missed_docs_count: 11,
+            },
+          ],
+          message: '1 job is suffering from delayed data.',
+        },
+      },
+    ]);
+  });
+
   test('returns results based on provided selection', async () => {
     const executionResult = await jobHealthService.getTestsResults('testRule_03', {
       testsConfig: null,
@@ -169,11 +253,17 @@ describe('JobsHealthService', () => {
       'test_job_01',
       'test_job_02',
     ]);
+    expect(datafeedsService.getDatafeedByJobId).toHaveBeenCalledTimes(1);
     expect(mlClient.getJobStats).toHaveBeenCalledWith({ job_id: 'test_job_01,test_job_02' });
     expect(mlClient.getDatafeedStats).toHaveBeenCalledWith({
       datafeed_id: 'test_datafeed_01,test_datafeed_02',
     });
     expect(mlClient.getJobStats).toHaveBeenCalledTimes(1);
+    expect(annotationService.getDelayedDataAnnotations).toHaveBeenCalledWith({
+      jobIds: ['test_job_01', 'test_job_02'],
+      earliestMs: 1487069268000,
+    });
+
     expect(executionResult).toEqual([
       {
         name: 'Datafeed is not started',
@@ -203,6 +293,28 @@ describe('JobsHealthService', () => {
             '1 job reached the hard model memory limit. Assign the job more memory and restore from a snapshot from prior to reaching the hard limit.',
         },
       },
+      {
+        name: 'Data delay has occurred',
+        context: {
+          results: [
+            {
+              job_id: 'test_job_01',
+              annotation:
+                'Datafeed has missed 11 documents due to ingest latency, latest bucket with missing data is [2021-07-30T13:50:00.000Z]. Consider increasing query_delay',
+              end_timestamp: 1627653300000,
+              missed_docs_count: 11,
+            },
+            {
+              job_id: 'test_job_02',
+              annotation:
+                'Datafeed has missed 8 documents due to ingest latency, latest bucket with missing data is [2021-07-30T13:50:00.000Z]. Consider increasing query_delay',
+              end_timestamp: 1627653300000,
+              missed_docs_count: 8,
+            },
+          ],
+          message: '2 jobs are suffering from delayed data.',
+        },
+      },
     ]);
   });
 });
diff --git a/x-pack/plugins/ml/server/lib/alerts/jobs_health_service.ts b/x-pack/plugins/ml/server/lib/alerts/jobs_health_service.ts
index 5c34a84abd9719..52e17fed7a4143 100644
--- a/x-pack/plugins/ml/server/lib/alerts/jobs_health_service.ts
+++ b/x-pack/plugins/ml/server/lib/alerts/jobs_health_service.ts
@@ -5,10 +5,11 @@
  * 2.0.
  */
 
+import { memoize, keyBy } from 'lodash';
 import { KibanaRequest, SavedObjectsClientContract } from 'kibana/server';
 import { i18n } from '@kbn/i18n';
 import { Logger } from 'kibana/server';
-import { MlJobStats } from '@elastic/elasticsearch/api/types';
+import { MlJob } from '@elastic/elasticsearch/api/types';
 import { MlClient } from '../ml_client';
 import {
   AnomalyDetectionJobsHealthRuleParams,
@@ -20,10 +21,18 @@ import { DatafeedStats } from '../../../common/types/anomaly_detection_jobs';
 import { GetGuards } from '../../shared_services/shared_services';
 import {
   AnomalyDetectionJobsHealthAlertContext,
+  DelayedDataResponse,
   MmlTestResponse,
   NotStartedDatafeedResponse,
 } from './register_jobs_monitoring_rule_type';
-import { getResultJobsHealthRuleConfig } from '../../../common/util/alerts';
+import {
+  getResultJobsHealthRuleConfig,
+  resolveLookbackInterval,
+} from '../../../common/util/alerts';
+import { AnnotationService } from '../../models/annotation_service/annotation';
+import { annotationServiceProvider } from '../../models/annotation_service';
+import { parseInterval } from '../../../common/util/parse_interval';
+import { isDefined } from '../../../common/types/guards';
 
 interface TestResult {
   name: string;
@@ -35,14 +44,18 @@ type TestsResults = TestResult[];
 export function jobsHealthServiceProvider(
   mlClient: MlClient,
   datafeedsService: DatafeedsService,
+  annotationService: AnnotationService,
   logger: Logger
 ) {
   /**
-   * Extracts result list of job ids based on included and excluded selection of jobs and groups.
+   * Extracts result list of jobs based on included and excluded selection of jobs and groups.
    * @param includeJobs
    * @param excludeJobs
    */
-  const getResultJobIds = async (includeJobs: JobSelection, excludeJobs?: JobSelection | null) => {
+  const getResultJobs = async (
+    includeJobs: JobSelection,
+    excludeJobs?: JobSelection | null
+  ): Promise<MlJob[]> => {
     const jobAndGroupIds = [...(includeJobs.jobIds ?? []), ...(includeJobs.groupIds ?? [])];
 
     const includeAllJobs = jobAndGroupIds.some((id) => id === ALL_JOBS_SELECTION);
@@ -54,7 +67,7 @@ export function jobsHealthServiceProvider(
       })
     ).body.jobs;
 
-    let resultJobIds = jobsResponse.map((v) => v.job_id);
+    let resultJobs = jobsResponse;
 
     if (excludeJobs && (!!excludeJobs.jobIds.length || !!excludeJobs?.groupIds.length)) {
       const excludedJobAndGroupIds = [
@@ -69,33 +82,41 @@ export function jobsHealthServiceProvider(
 
       const excludedJobsIds: Set<string> = new Set(excludedJobsResponse.map((v) => v.job_id));
 
-      resultJobIds = resultJobIds.filter((v) => !excludedJobsIds.has(v));
+      resultJobs = resultJobs.filter((v) => !excludedJobsIds.has(v.job_id));
     }
 
-    return resultJobIds;
+    return resultJobs;
   };
 
-  const getJobStats: (jobIds: string[]) => Promise<MlJobStats[]> = (() => {
-    const cachedStats = new Map<string, MlJobStats>();
+  /**
+   * Resolves the timestamp for delayed data check.
+   *
+   * @param timeInterval - Custom time interval provided by the user.
+   * @param defaultLookbackInterval - Interval derived from the jobs and datefeeds configs.
+   */
+  const getDelayedDataLookbackTimestamp = (
+    timeInterval: string | null,
+    defaultLookbackInterval: string
+  ): number => {
+    const currentTimestamp = Date.now();
 
-    return async (jobIds: string[]) => {
-      if (jobIds.every((j) => cachedStats.has(j))) {
-        logger.debug(`Return jobs stats from cache`);
-        return Array.from(cachedStats.values());
-      }
+    const defaultLookbackTimestamp =
+      currentTimestamp - parseInterval(defaultLookbackInterval)!.asMilliseconds();
 
-      const {
-        body: { jobs: jobsStats },
-      } = await mlClient.getJobStats({ job_id: jobIds.join(',') });
+    const customIntervalOffsetTimestamp = timeInterval
+      ? currentTimestamp - parseInterval(timeInterval)!.asMilliseconds()
+      : null;
 
-      // update cache
-      jobsStats.forEach((v) => {
-        cachedStats.set(v.job_id, v);
-      });
+    return Math.min(...[defaultLookbackTimestamp, customIntervalOffsetTimestamp].filter(isDefined));
+  };
 
-      return jobsStats;
-    };
-  })();
+  const getJobIds = memoize((jobs: MlJob[]) => jobs.map((j) => j.job_id));
+
+  const getDatafeeds = memoize(datafeedsService.getDatafeedByJobId);
+
+  const getJobStats = memoize(
+    async (jobIds: string[]) => (await mlClient.getJobStats({ job_id: jobIds.join(',') })).body.jobs
+  );
 
   return {
     /**
@@ -103,7 +124,7 @@ export function jobsHealthServiceProvider(
      * @param jobIds
      */
     async getNotStartedDatafeeds(jobIds: string[]): Promise<NotStartedDatafeedResponse[] | void> {
-      const datafeeds = await datafeedsService.getDatafeedByJobId(jobIds);
+      const datafeeds = await getDatafeeds(jobIds);
 
       if (datafeeds) {
         const jobsStats = await getJobStats(jobIds);
@@ -154,6 +175,67 @@ export function jobsHealthServiceProvider(
           };
         });
     },
+    /**
+     * Returns annotations about delayed data.
+     *
+     * @param jobs
+     * @param timeInterval - Custom time interval provided by the user.
+     * @param docsCount - The threshold for a number of missing documents to alert upon.
+     */
+    async getDelayedDataReport(
+      jobs: MlJob[],
+      timeInterval: string | null,
+      docsCount: number | null
+    ): Promise<DelayedDataResponse[]> {
+      const jobIds = getJobIds(jobs);
+      const datafeeds = await getDatafeeds(jobIds);
+
+      const datafeedsMap = keyBy(datafeeds, 'job_id');
+
+      // We shouldn't check jobs that don't have associated datafeeds
+      const resultJobs = jobs.filter((j) => datafeedsMap[j.job_id] !== undefined);
+      const resultJobIds = getJobIds(resultJobs);
+      const jobsMap = keyBy(resultJobs, 'job_id');
+
+      const defaultLookbackInterval = resolveLookbackInterval(resultJobs, datafeeds!);
+      const earliestMs = getDelayedDataLookbackTimestamp(timeInterval, defaultLookbackInterval);
+
+      const annotations: DelayedDataResponse[] = (
+        await annotationService.getDelayedDataAnnotations({
+          jobIds: resultJobIds,
+          earliestMs,
+        })
+      )
+        .map<DelayedDataResponse>((v) => {
+          const match = v.annotation.match(/Datafeed has missed (\d+)\s/);
+          const missedDocsCount = match ? parseInt(match[1], 10) : 0;
+          return {
+            annotation: v.annotation,
+            // end_timestamp is always defined for delayed_data annotation
+            end_timestamp: v.end_timestamp!,
+            missed_docs_count: missedDocsCount,
+            job_id: v.job_id,
+          };
+        })
+        .filter((v) => {
+          // As we retrieved annotations based on the longest bucket span and query delay,
+          // we need to check end_timestamp against appropriate job configuration.
+
+          const job = jobsMap[v.job_id];
+          const datafeed = datafeedsMap[v.job_id];
+
+          const isDocCountExceededThreshold = docsCount ? v.missed_docs_count >= docsCount : true;
+
+          const jobLookbackInterval = resolveLookbackInterval([job], [datafeed]);
+
+          const isEndTimestampWithinRange =
+            v.end_timestamp > getDelayedDataLookbackTimestamp(timeInterval, jobLookbackInterval);
+
+          return isDocCountExceededThreshold && isEndTimestampWithinRange;
+        });
+
+      return annotations;
+    },
     /**
      * Retrieves report grouped by test.
      */
@@ -165,7 +247,8 @@ export function jobsHealthServiceProvider(
 
       const results: TestsResults = [];
 
-      const jobIds = await getResultJobIds(includeJobs, excludeJobs);
+      const jobs = await getResultJobs(includeJobs, excludeJobs);
+      const jobIds = getJobIds(jobs);
 
       if (jobIds.length === 0) {
         logger.warn(`Rule "${ruleInstanceName}" does not have associated jobs.`);
@@ -178,7 +261,7 @@ export function jobsHealthServiceProvider(
         const response = await this.getNotStartedDatafeeds(jobIds);
         if (response && response.length > 0) {
           results.push({
-            name: HEALTH_CHECK_NAMES.datafeed,
+            name: HEALTH_CHECK_NAMES.datafeed.name,
             context: {
               results: response,
               message: i18n.translate(
@@ -200,7 +283,7 @@ export function jobsHealthServiceProvider(
           }, 0);
 
           results.push({
-            name: HEALTH_CHECK_NAMES.mml,
+            name: HEALTH_CHECK_NAMES.mml.name,
             context: {
               results: response,
               message:
@@ -226,6 +309,31 @@ export function jobsHealthServiceProvider(
         }
       }
 
+      if (config.delayedData.enabled) {
+        const response = await this.getDelayedDataReport(
+          jobs,
+          config.delayedData.timeInterval,
+          config.delayedData.docsCount
+        );
+
+        if (response.length > 0) {
+          results.push({
+            name: HEALTH_CHECK_NAMES.delayedData.name,
+            context: {
+              results: response,
+              message: i18n.translate(
+                'xpack.ml.alertTypes.jobsHealthAlertingRule.delayedDataMessage',
+                {
+                  defaultMessage:
+                    '{jobsCount, plural, one {# job is} other {# jobs are}} suffering from delayed data.',
+                  values: { jobsCount: response.length },
+                }
+              ),
+            },
+          });
+        }
+      }
+
       return results;
     },
   };
@@ -251,6 +359,7 @@ export function getJobsHealthServiceProvider(getGuards: GetGuards) {
               jobsHealthServiceProvider(
                 mlClient,
                 datafeedsProvider(scopedClient, mlClient),
+                annotationServiceProvider(scopedClient),
                 logger
               ).getTestsResults(...args)
             );
diff --git a/x-pack/plugins/ml/server/lib/alerts/register_jobs_monitoring_rule_type.ts b/x-pack/plugins/ml/server/lib/alerts/register_jobs_monitoring_rule_type.ts
index 0e4270fb94e3be..063d8ad5a89803 100644
--- a/x-pack/plugins/ml/server/lib/alerts/register_jobs_monitoring_rule_type.ts
+++ b/x-pack/plugins/ml/server/lib/alerts/register_jobs_monitoring_rule_type.ts
@@ -42,7 +42,20 @@ export interface NotStartedDatafeedResponse {
   job_state: MlJobState;
 }
 
-export type AnomalyDetectionJobHealthResult = MmlTestResponse | NotStartedDatafeedResponse;
+export interface DelayedDataResponse {
+  job_id: string;
+  /** Annotation string */
+  annotation: string;
+  /** Number of missed documents */
+  missed_docs_count: number;
+  /** Timestamp of the latest finalized bucket with missing docs */
+  end_timestamp: number;
+}
+
+export type AnomalyDetectionJobHealthResult =
+  | MmlTestResponse
+  | NotStartedDatafeedResponse
+  | DelayedDataResponse;
 
 export type AnomalyDetectionJobsHealthAlertContext = {
   results: AnomalyDetectionJobHealthResult[];
@@ -107,7 +120,7 @@ export function registerJobsMonitoringRuleType({
     producer: PLUGIN_ID,
     minimumLicenseRequired: MINIMUM_FULL_LICENSE,
     isExportable: true,
-    async executor({ services, params, alertId, state, previousStartedAt, startedAt, name }) {
+    async executor({ services, params, alertId, state, previousStartedAt, startedAt, name, rule }) {
       const fakeRequest = {} as KibanaRequest;
       const { getTestsResults } = mlServicesProviders.jobsHealthServiceProvider(
         services.savedObjectsClient,
diff --git a/x-pack/plugins/ml/server/models/annotation_service/annotation.ts b/x-pack/plugins/ml/server/models/annotation_service/annotation.ts
index c5f3c152ddc7ae..9552735a57d358 100644
--- a/x-pack/plugins/ml/server/models/annotation_service/annotation.ts
+++ b/x-pack/plugins/ml/server/models/annotation_service/annotation.ts
@@ -9,6 +9,7 @@ import Boom from '@hapi/boom';
 import { each, get } from 'lodash';
 import { IScopedClusterClient } from 'kibana/server';
 
+import { estypes } from '@elastic/elasticsearch';
 import { ANNOTATION_EVENT_USER, ANNOTATION_TYPE } from '../../../common/constants/annotations';
 import { PARTITION_FIELDS } from '../../../common/constants/anomalies';
 import {
@@ -25,6 +26,7 @@ import {
   getAnnotationFieldValue,
   EsAggregationResult,
 } from '../../../common/types/annotations';
+import { JobId } from '../../../common/types/anomaly_detection_jobs';
 
 // TODO All of the following interface/type definitions should
 // eventually be replaced by the proper upstream definitions
@@ -46,6 +48,7 @@ export interface IndexAnnotationArgs {
   fields?: FieldToBucket[];
   detectorIndex?: number;
   entities?: any[];
+  event?: Annotation['event'];
 }
 
 export interface AggTerm {
@@ -60,7 +63,7 @@ export interface GetParams {
 
 export interface GetResponse {
   success: true;
-  annotations: Record<string, Annotations>;
+  annotations: Record<JobId, Annotations>;
   aggregations: EsAggregationResult;
 }
 
@@ -116,7 +119,8 @@ export function annotationProvider({ asInternalUser }: IScopedClusterClient) {
     fields,
     detectorIndex,
     entities,
-  }: IndexAnnotationArgs) {
+    event,
+  }: IndexAnnotationArgs): Promise<GetResponse> {
     const obj: GetResponse = {
       success: true,
       annotations: {},
@@ -190,6 +194,12 @@ export function annotationProvider({ asInternalUser }: IScopedClusterClient) {
       exists: { field: 'annotation' },
     });
 
+    if (event) {
+      boolCriteria.push({
+        term: { event },
+      });
+    }
+
     if (jobIds && jobIds.length > 0 && !(jobIds.length === 1 && jobIds[0] === '*')) {
       let jobIdFilterStr = '';
       each(jobIds, (jobId, i: number) => {
@@ -332,6 +342,68 @@ export function annotationProvider({ asInternalUser }: IScopedClusterClient) {
     }
   }
 
+  /**
+   * Fetches the latest delayed data annotation per job.
+   * @param jobIds
+   * @param earliestMs - Timestamp for the end_timestamp range query.
+   */
+  async function getDelayedDataAnnotations({
+    jobIds,
+    earliestMs,
+  }: {
+    jobIds: string[];
+    earliestMs?: number;
+  }): Promise<Annotation[]> {
+    const params: estypes.SearchRequest = {
+      index: ML_ANNOTATIONS_INDEX_ALIAS_READ,
+      size: 0,
+      body: {
+        query: {
+          bool: {
+            filter: [
+              ...(earliestMs ? [{ range: { end_timestamp: { gte: earliestMs } } }] : []),
+              {
+                term: { event: { value: 'delayed_data' } },
+              },
+              { terms: { job_id: jobIds } },
+            ],
+          },
+        },
+        aggs: {
+          by_job: {
+            terms: { field: 'job_id', size: jobIds.length },
+            aggs: {
+              latest_delayed: {
+                top_hits: {
+                  size: 1,
+                  sort: [
+                    {
+                      end_timestamp: {
+                        order: 'desc',
+                      },
+                    },
+                  ],
+                },
+              },
+            },
+          },
+        },
+      },
+    };
+
+    const { body } = await asInternalUser.search<Annotation>(params);
+
+    const annotations = (body.aggregations!.by_job as estypes.AggregationsTermsAggregate<{
+      key: string;
+      doc_count: number;
+      latest_delayed: Pick<estypes.SearchResponse<Annotation>, 'hits'>;
+    }>).buckets.map((bucket) => {
+      return bucket.latest_delayed.hits.hits[0]._source!;
+    });
+
+    return annotations;
+  }
+
   async function deleteAnnotation(id: string) {
     const params: DeleteParams = {
       index: ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
@@ -347,5 +419,8 @@ export function annotationProvider({ asInternalUser }: IScopedClusterClient) {
     getAnnotations,
     indexAnnotation,
     deleteAnnotation,
+    getDelayedDataAnnotations,
   };
 }
+
+export type AnnotationService = ReturnType<typeof annotationProvider>;
diff --git a/x-pack/plugins/ml/server/routes/schemas/alerting_schema.ts b/x-pack/plugins/ml/server/routes/schemas/alerting_schema.ts
index 4e0f9a9aa7c928..ed58d8d5c9313e 100644
--- a/x-pack/plugins/ml/server/routes/schemas/alerting_schema.ts
+++ b/x-pack/plugins/ml/server/routes/schemas/alerting_schema.ts
@@ -79,7 +79,7 @@ export const anomalyDetectionJobsHealthRuleParams = schema.object({
       delayedData: schema.nullable(
         schema.object({
           enabled: schema.boolean({ defaultValue: true }),
-          docsCount: schema.nullable(schema.number()),
+          docsCount: schema.nullable(schema.number({ min: 1 })),
           timeInterval: schema.nullable(schema.string()),
         })
       ),
diff --git a/x-pack/plugins/ml/server/routes/schemas/annotations_schema.ts b/x-pack/plugins/ml/server/routes/schemas/annotations_schema.ts
index 96edbeb0fce0ec..73e876f0a91220 100644
--- a/x-pack/plugins/ml/server/routes/schemas/annotations_schema.ts
+++ b/x-pack/plugins/ml/server/routes/schemas/annotations_schema.ts
@@ -21,7 +21,15 @@ export const indexAnnotationSchema = schema.object({
   create_username: schema.maybe(schema.string()),
   modified_time: schema.maybe(schema.number()),
   modified_username: schema.maybe(schema.string()),
-  event: schema.maybe(schema.string()),
+  event: schema.maybe(
+    schema.oneOf([
+      schema.literal('user'),
+      schema.literal('delayed_data'),
+      schema.literal('model_snapshot_stored'),
+      schema.literal('model_change'),
+      schema.literal('categorization_status_change'),
+    ])
+  ),
   detector_index: schema.maybe(schema.number()),
   partition_field_name: schema.maybe(schema.string()),
   partition_field_value: schema.maybe(schema.string()),
diff --git a/x-pack/plugins/monitoring/public/angular/app_modules.ts b/x-pack/plugins/monitoring/public/angular/app_modules.ts
index e7b2f7a5370009..20989e080edbf9 100644
--- a/x-pack/plugins/monitoring/public/angular/app_modules.ts
+++ b/x-pack/plugins/monitoring/public/angular/app_modules.ts
@@ -52,7 +52,7 @@ export const appModuleName = 'monitoring';
 
 type IPrivate = <T>(provider: (...injectable: unknown[]) => T) => T;
 
-const thirdPartyAngularDependencies = ['ngSanitize', 'ngRoute', 'react', 'ui.bootstrap'];
+const thirdPartyAngularDependencies = ['ngSanitize', 'ngRoute', 'react'];
 
 export const localAppModule = ({
   core,
diff --git a/x-pack/plugins/monitoring/public/components/no_data/explanations/collection_enabled/__snapshots__/collection_enabled.test.js.snap b/x-pack/plugins/monitoring/public/components/no_data/explanations/collection_enabled/__snapshots__/collection_enabled.test.js.snap
index a36b09edf1fd37..cab1e9190a8b31 100644
--- a/x-pack/plugins/monitoring/public/components/no_data/explanations/collection_enabled/__snapshots__/collection_enabled.test.js.snap
+++ b/x-pack/plugins/monitoring/public/components/no_data/explanations/collection_enabled/__snapshots__/collection_enabled.test.js.snap
@@ -138,6 +138,7 @@ exports[`ExplainCollectionEnabled should explain about xpack.monitoring.collecti
     >
       <span
         className="euiTextColor euiTextColor--subdued"
+        style={Object {}}
       >
         <EuiText>
           <div
diff --git a/x-pack/plugins/monitoring/public/components/no_data/explanations/collection_interval/__snapshots__/collection_interval.test.js.snap b/x-pack/plugins/monitoring/public/components/no_data/explanations/collection_interval/__snapshots__/collection_interval.test.js.snap
index ebc4a9fa885f31..80802e4e77029b 100644
--- a/x-pack/plugins/monitoring/public/components/no_data/explanations/collection_interval/__snapshots__/collection_interval.test.js.snap
+++ b/x-pack/plugins/monitoring/public/components/no_data/explanations/collection_interval/__snapshots__/collection_interval.test.js.snap
@@ -311,6 +311,7 @@ exports[`ExplainCollectionInterval collection interval setting updates should sh
     >
       <span
         className="euiTextColor euiTextColor--subdued"
+        style={Object {}}
       >
         <EuiText>
           <div
@@ -637,6 +638,7 @@ exports[`ExplainCollectionInterval should explain about xpack.monitoring.collect
     >
       <span
         className="euiTextColor euiTextColor--subdued"
+        style={Object {}}
       >
         <EuiText>
           <div
diff --git a/x-pack/plugins/monitoring/public/plugin.ts b/x-pack/plugins/monitoring/public/plugin.ts
index f1a9c2708d5d65..15b7290fbeaf72 100644
--- a/x-pack/plugins/monitoring/public/plugin.ts
+++ b/x-pack/plugins/monitoring/public/plugin.ts
@@ -93,10 +93,7 @@ export class MonitoringPlugin
       category: DEFAULT_APP_CATEGORIES.management,
       mount: async (params: AppMountParameters) => {
         const [coreStart, pluginsStart] = await core.getStartServices();
-        const [, { AngularApp }] = await Promise.all([
-          pluginsStart.kibanaLegacy.loadAngularBootstrap(),
-          import('./angular'),
-        ]);
+        const { AngularApp } = await import('./angular');
         const deps: MonitoringStartPluginDependencies = {
           navigation: pluginsStart.navigation,
           kibanaLegacy: pluginsStart.kibanaLegacy,
diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/utils/observability_index_patterns.ts b/x-pack/plugins/observability/public/components/shared/exploratory_view/utils/observability_index_patterns.ts
index 964de86ddf377e..b61af3a61c3dc1 100644
--- a/x-pack/plugins/observability/public/components/shared/exploratory_view/utils/observability_index_patterns.ts
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/utils/observability_index_patterns.ts
@@ -5,11 +5,11 @@
  * 2.0.
  */
 
+import type { FieldFormat as IFieldFormat } from 'src/plugins/field_formats/common';
 import { SavedObjectNotFound } from '../../../../../../../../src/plugins/kibana_utils/public';
 import {
   DataPublicPluginStart,
   IndexPattern,
-  FieldFormat as IFieldFormat,
   IndexPatternSpec,
 } from '../../../../../../../../src/plugins/data/public';
 import { rumFieldFormats } from '../configurations/rum/field_formats';
diff --git a/x-pack/plugins/observability/public/pages/alerts/alerts_table_t_grid.tsx b/x-pack/plugins/observability/public/pages/alerts/alerts_table_t_grid.tsx
index cd8965de36f1c0..4bc9c40e6e9178 100644
--- a/x-pack/plugins/observability/public/pages/alerts/alerts_table_t_grid.tsx
+++ b/x-pack/plugins/observability/public/pages/alerts/alerts_table_t_grid.tsx
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { AlertConsumers } from '@kbn/rule-data-utils/target/alerts_as_data_rbac';
 import { EuiButtonIcon, EuiDataGridColumn } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import styled from 'styled-components';
@@ -31,6 +32,7 @@ import type {
 import { getRenderCellValue } from './render_cell_value';
 import { usePluginContext } from '../../hooks/use_plugin_context';
 import { decorateResponse } from './decorate_response';
+import { getDefaultCellActions } from './default_cell_actions';
 import { LazyAlertsFlyout } from '../..';
 
 interface AlertsTableTGridProps {
@@ -114,6 +116,13 @@ const NO_ROW_RENDER: RowRenderer[] = [];
 
 const trailingControlColumns: never[] = [];
 
+const OBSERVABILITY_ALERT_CONSUMERS = [
+  AlertConsumers.APM,
+  AlertConsumers.LOGS,
+  AlertConsumers.INFRASTRUCTURE,
+  AlertConsumers.SYNTHETICS,
+];
+
 export function AlertsTableTGrid(props: AlertsTableTGridProps) {
   const { core, observabilityRuleTypeRegistry } = usePluginContext();
   const { prepend } = core.http.basePath;
@@ -189,9 +198,11 @@ export function AlertsTableTGrid(props: AlertsTableTGridProps) {
         </Suspense>
       )}
       {timelines.getTGrid<'standalone'>({
+        alertConsumers: OBSERVABILITY_ALERT_CONSUMERS,
         type: 'standalone',
         columns,
         deletedEventIds: [],
+        defaultCellActions: getDefaultCellActions({ enableFilterActions: false }),
         end: rangeTo,
         filters: [],
         indexNames: [indexName],
diff --git a/x-pack/plugins/observability/public/pages/alerts/default_cell_actions.tsx b/x-pack/plugins/observability/public/pages/alerts/default_cell_actions.tsx
new file mode 100644
index 00000000000000..3056b026fc27ae
--- /dev/null
+++ b/x-pack/plugins/observability/public/pages/alerts/default_cell_actions.tsx
@@ -0,0 +1,109 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { ObservabilityPublicPluginsStart } from '../..';
+import { getMappedNonEcsValue } from './render_cell_value';
+import { useKibana } from '../../../../../../src/plugins/kibana_react/public';
+import { TimelineNonEcsData } from '../../../../timelines/common/search_strategy';
+import { TGridCellAction } from '../../../../timelines/common/types/timeline';
+import { TimelinesUIStart } from '../../../../timelines/public';
+
+/** a noop required by the filter in / out buttons */
+const onFilterAdded = () => {};
+
+/** a hook to eliminate the verbose boilerplate required to use common services */
+const useKibanaServices = () => {
+  const { timelines } = useKibana<{ timelines: TimelinesUIStart }>().services;
+  const {
+    services: {
+      data: {
+        query: { filterManager },
+      },
+    },
+  } = useKibana<ObservabilityPublicPluginsStart>();
+
+  return { timelines, filterManager };
+};
+
+/** actions for adding filters to the search bar */
+const filterCellActions: TGridCellAction[] = [
+  ({ data }: { data: TimelineNonEcsData[][] }) => ({ rowIndex, columnId, Component }) => {
+    const { timelines, filterManager } = useKibanaServices();
+
+    const value = getMappedNonEcsValue({
+      data: data[rowIndex],
+      fieldName: columnId,
+    });
+
+    return (
+      <>
+        {timelines.getHoverActions().getFilterForValueButton({
+          Component,
+          field: columnId,
+          filterManager,
+          onFilterAdded,
+          ownFocus: false,
+          showTooltip: false,
+          value,
+        })}
+      </>
+    );
+  },
+  ({ data }: { data: TimelineNonEcsData[][] }) => ({ rowIndex, columnId, Component }) => {
+    const { timelines, filterManager } = useKibanaServices();
+
+    const value = getMappedNonEcsValue({
+      data: data[rowIndex],
+      fieldName: columnId,
+    });
+
+    return (
+      <>
+        {timelines.getHoverActions().getFilterOutValueButton({
+          Component,
+          field: columnId,
+          filterManager,
+          onFilterAdded,
+          ownFocus: false,
+          showTooltip: false,
+          value,
+        })}
+      </>
+    );
+  },
+];
+
+/** actions common to all cells (e.g. copy to clipboard) */
+const commonCellActions: TGridCellAction[] = [
+  ({ data }: { data: TimelineNonEcsData[][] }) => ({ rowIndex, columnId, Component }) => {
+    const { timelines } = useKibanaServices();
+
+    const value = getMappedNonEcsValue({
+      data: data[rowIndex],
+      fieldName: columnId,
+    });
+
+    return (
+      <>
+        {timelines.getHoverActions().getCopyButton({
+          Component,
+          field: columnId,
+          isHoverAction: false,
+          ownFocus: false,
+          showTooltip: false,
+          value,
+        })}
+      </>
+    );
+  },
+];
+
+/** returns the default actions shown in `EuiDataGrid` cells */
+export const getDefaultCellActions = ({ enableFilterActions }: { enableFilterActions: boolean }) =>
+  enableFilterActions ? [...filterCellActions, ...commonCellActions] : [...commonCellActions];
diff --git a/x-pack/plugins/observability/public/pages/alerts/render_cell_value.tsx b/x-pack/plugins/observability/public/pages/alerts/render_cell_value.tsx
index bb6d0ae6c0e407..cac3240cd20048 100644
--- a/x-pack/plugins/observability/public/pages/alerts/render_cell_value.tsx
+++ b/x-pack/plugins/observability/public/pages/alerts/render_cell_value.tsx
@@ -23,7 +23,7 @@ import { TopAlert } from '.';
 import { decorateResponse } from './decorate_response';
 import { usePluginContext } from '../../hooks/use_plugin_context';
 
-const getMappedNonEcsValue = ({
+export const getMappedNonEcsValue = ({
   data,
   fieldName,
 }: {
diff --git a/x-pack/plugins/observability/public/services/call_observability_api/index.ts b/x-pack/plugins/observability/public/services/call_observability_api/index.ts
index c87a97fb1dc8a9..7b1b9d222b36e8 100644
--- a/x-pack/plugins/observability/public/services/call_observability_api/index.ts
+++ b/x-pack/plugins/observability/public/services/call_observability_api/index.ts
@@ -5,7 +5,9 @@
  * 2.0.
  */
 
-import { formatRequest } from '@kbn/server-route-repository/target/format_request';
+// @ts-expect-error
+import { formatRequest } from '@kbn/server-route-repository/target_node/format_request';
+import type { formatRequest as formatRequestType } from '@kbn/server-route-repository/target_types/format_request';
 import type { HttpSetup } from 'kibana/public';
 import type { AbstractObservabilityClient, ObservabilityClient } from './types';
 
@@ -17,7 +19,9 @@ export function createCallObservabilityApi(http: HttpSetup) {
   const client: AbstractObservabilityClient = (options) => {
     const { params: { path, body, query } = {}, endpoint, ...rest } = options;
 
-    const { method, pathname } = formatRequest(endpoint, path);
+    const { method, pathname } = formatRequest(endpoint, path) as ReturnType<
+      typeof formatRequestType
+    >;
 
     return http[method](pathname, {
       ...rest,
diff --git a/x-pack/plugins/reporting/common/types.ts b/x-pack/plugins/reporting/common/types.ts
index f3a0e9192cf7dc..7bcf69b564b3c7 100644
--- a/x-pack/plugins/reporting/common/types.ts
+++ b/x-pack/plugins/reporting/common/types.ts
@@ -44,7 +44,7 @@ export interface ReportDocumentHead {
   _primary_term: number;
 }
 
-export interface TaskRunResult {
+export interface ReportOutput {
   content_type: string | null;
   content: string | null;
   size: number;
@@ -53,6 +53,8 @@ export interface TaskRunResult {
   warnings?: string[];
 }
 
+export type TaskRunResult = Omit<ReportOutput, 'content'>;
+
 export interface ReportSource {
   /*
    * Required fields: populated in enqueue_job when the request comes in to
@@ -73,7 +75,7 @@ export interface ReportSource {
   /*
    * `output` is only populated if the report job is completed or failed.
    */
-  output: TaskRunResult | null;
+  output: ReportOutput | null;
 
   /*
    * Optional fields: populated when the job is claimed to execute, and after
@@ -120,12 +122,6 @@ export type JobStatus =
   | 'processing' // Report job has been claimed and is executing
   | 'failed'; // Report was not successful, and all retries are done. Nothing to download.
 
-// payload for retrieving the error message of a failed job
-export interface JobContent {
-  content: TaskRunResult['content'];
-  content_type: false;
-}
-
 /*
  * Info API response: to avoid unnecessary large payloads on a network, the
  * report query results do not include `payload.headers` or `output.content`,
@@ -133,7 +129,7 @@ export interface JobContent {
  */
 interface ReportSimple extends Omit<ReportSource, 'payload' | 'output'> {
   payload: Omit<ReportSource['payload'], 'headers'>;
-  output?: Omit<TaskRunResult, 'content'>; // is undefined for report jobs that are not completed
+  output?: Omit<ReportOutput, 'content'>; // is undefined for report jobs that are not completed
 }
 
 /*
diff --git a/x-pack/plugins/reporting/public/management/__snapshots__/report_listing.test.tsx.snap b/x-pack/plugins/reporting/public/management/__snapshots__/report_listing.test.tsx.snap
index d78a09bc6af524..89511aaf96a675 100644
--- a/x-pack/plugins/reporting/public/management/__snapshots__/report_listing.test.tsx.snap
+++ b/x-pack/plugins/reporting/public/management/__snapshots__/report_listing.test.tsx.snap
@@ -443,6 +443,7 @@ exports[`ReportListing Report job listing with some items 1`] = `
                             >
                               <span
                                 className="euiTextColor euiTextColor--subdued"
+                                style={Object {}}
                               >
                                 canvas workpad
                               </span>
@@ -559,6 +560,7 @@ exports[`ReportListing Report job listing with some items 1`] = `
                             >
                               <span
                                 className="euiTextColor euiTextColor--subdued"
+                                style={Object {}}
                               >
                                 Waiting for job to be processed.
                               </span>
@@ -1454,6 +1456,7 @@ exports[`ReportListing Report job listing with some items 1`] = `
                             >
                               <span
                                 className="euiTextColor euiTextColor--subdued"
+                                style={Object {}}
                               >
                                 canvas workpad
                               </span>
@@ -1570,6 +1573,7 @@ exports[`ReportListing Report job listing with some items 1`] = `
                             >
                               <span
                                 className="euiTextColor euiTextColor--subdued"
+                                style={Object {}}
                               >
                                 Attempt 1 of 1.
                               </span>
@@ -2465,6 +2469,7 @@ exports[`ReportListing Report job listing with some items 1`] = `
                             >
                               <span
                                 className="euiTextColor euiTextColor--subdued"
+                                style={Object {}}
                               >
                                 canvas workpad
                               </span>
@@ -3506,6 +3511,7 @@ exports[`ReportListing Report job listing with some items 1`] = `
                             >
                               <span
                                 className="euiTextColor euiTextColor--subdued"
+                                style={Object {}}
                               >
                                 canvas workpad
                               </span>
@@ -3622,6 +3628,7 @@ exports[`ReportListing Report job listing with some items 1`] = `
                             >
                               <span
                                 className="euiTextColor euiTextColor--subdued"
+                                style={Object {}}
                               >
                                 See report info for warnings.
                               </span>
@@ -4574,6 +4581,7 @@ exports[`ReportListing Report job listing with some items 1`] = `
                             >
                               <span
                                 className="euiTextColor euiTextColor--subdued"
+                                style={Object {}}
                               >
                                 canvas workpad
                               </span>
@@ -5615,6 +5623,7 @@ exports[`ReportListing Report job listing with some items 1`] = `
                             >
                               <span
                                 className="euiTextColor euiTextColor--subdued"
+                                style={Object {}}
                               >
                                 canvas workpad
                               </span>
@@ -6656,6 +6665,7 @@ exports[`ReportListing Report job listing with some items 1`] = `
                             >
                               <span
                                 className="euiTextColor euiTextColor--subdued"
+                                style={Object {}}
                               >
                                 canvas workpad
                               </span>
@@ -7697,6 +7707,7 @@ exports[`ReportListing Report job listing with some items 1`] = `
                             >
                               <span
                                 className="euiTextColor euiTextColor--subdued"
+                                style={Object {}}
                               >
                                 canvas workpad
                               </span>
@@ -8738,6 +8749,7 @@ exports[`ReportListing Report job listing with some items 1`] = `
                             >
                               <span
                                 className="euiTextColor euiTextColor--subdued"
+                                style={Object {}}
                               >
                                 visualization
                               </span>
diff --git a/x-pack/plugins/reporting/server/export_types/csv/execute_job.test.ts b/x-pack/plugins/reporting/server/export_types/csv/execute_job.test.ts
index 0e8a7016b853b4..835eddc03d9f91 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/execute_job.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/execute_job.test.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { Writable } from 'stream';
 import type { DeeplyMockedKeys } from '@kbn/utility-types/jest';
 import nodeCrypto from '@elastic/node-crypto';
 import { ElasticsearchClient, IUiSettingsClient } from 'kibana/server';
@@ -13,7 +14,11 @@ import moment from 'moment';
 import Puid from 'puid';
 import sinon from 'sinon';
 import { ReportingConfig, ReportingCore } from '../../';
-import { fieldFormats, UI_SETTINGS } from '../../../../../../src/plugins/data/server';
+import {
+  FieldFormatsRegistry,
+  StringFormat,
+  FORMATS_UI_SETTINGS,
+} from '../../../../../../src/plugins/field_formats/common';
 import {
   CSV_QUOTE_VALUES_SETTING,
   CSV_SEPARATOR_SETTING,
@@ -56,6 +61,8 @@ describe('CSV Execute Job', function () {
   let mockReportingConfig: ReportingConfig;
   let mockReportingCore: ReportingCore;
   let cancellationToken: any;
+  let stream: jest.Mocked<Writable>;
+  let content: string;
 
   const mockUiSettingsClient = {
     get: sinon.stub(),
@@ -67,6 +74,8 @@ describe('CSV Execute Job', function () {
   });
 
   beforeEach(async function () {
+    content = '';
+    stream = ({ write: jest.fn((chunk) => (content += chunk)) } as unknown) as typeof stream;
     configGetStub = sinon.stub();
     configGetStub.withArgs('queue', 'timeout').returns(moment.duration('2m'));
     configGetStub.withArgs('index').returns('.reporting-foo-test');
@@ -99,15 +108,13 @@ describe('CSV Execute Job', function () {
     setFieldFormats({
       fieldFormatServiceFactory() {
         const uiConfigMock = {};
-        (uiConfigMock as any)[UI_SETTINGS.FORMAT_DEFAULT_TYPE_MAP] = {
+        (uiConfigMock as any)[FORMATS_UI_SETTINGS.FORMAT_DEFAULT_TYPE_MAP] = {
           _default_: { id: 'string', params: {} },
         };
 
-        const fieldFormatsRegistry = new fieldFormats.FieldFormatsRegistry();
+        const fieldFormatsRegistry = new FieldFormatsRegistry();
 
-        fieldFormatsRegistry.init((key) => (uiConfigMock as any)[key], {}, [
-          fieldFormats.StringFormat,
-        ]);
+        fieldFormatsRegistry.init((key) => (uiConfigMock as any)[key], {}, [StringFormat]);
 
         return Promise.resolve(fieldFormatsRegistry);
       },
@@ -124,7 +131,8 @@ describe('CSV Execute Job', function () {
           fields: [],
           searchRequest: { index: null, body: null },
         }),
-        cancellationToken
+        cancellationToken,
+        stream
       );
       expect(mockEsClient.search).toHaveBeenCalled();
     });
@@ -145,7 +153,7 @@ describe('CSV Execute Job', function () {
         },
       });
 
-      await runTask('job777', job, cancellationToken);
+      await runTask('job777', job, cancellationToken, stream);
 
       expect(mockEsClient.search).toHaveBeenCalledWith(expect.objectContaining({ body, index }));
     });
@@ -171,7 +179,8 @@ describe('CSV Execute Job', function () {
           fields: [],
           searchRequest: { index: null, body: null },
         }),
-        cancellationToken
+        cancellationToken,
+        stream
       );
 
       expect(mockEsClient.scroll).toHaveBeenCalledWith(
@@ -188,7 +197,8 @@ describe('CSV Execute Job', function () {
           fields: [],
           searchRequest: { index: null, body: null },
         }),
-        cancellationToken
+        cancellationToken,
+        stream
       );
 
       expect(mockEsClient.search).toHaveBeenCalled();
@@ -221,7 +231,8 @@ describe('CSV Execute Job', function () {
           fields: [],
           searchRequest: { index: null, body: null },
         }),
-        cancellationToken
+        cancellationToken,
+        stream
       );
 
       expect(mockEsClient.search).toHaveBeenCalled();
@@ -257,7 +268,8 @@ describe('CSV Execute Job', function () {
           fields: [],
           searchRequest: { index: null, body: null },
         }),
-        cancellationToken
+        cancellationToken,
+        stream
       );
 
       expect(mockEsClient.clearScroll).toHaveBeenCalledWith(
@@ -290,9 +302,9 @@ describe('CSV Execute Job', function () {
         conflictedTypesFields: undefined,
         searchRequest: { index: null, body: null },
       });
-      await expect(runTask('job123', jobParams, cancellationToken)).rejects.toMatchInlineSnapshot(
-        `[TypeError: Cannot read property 'indexOf' of undefined]`
-      );
+      await expect(
+        runTask('job123', jobParams, cancellationToken, stream)
+      ).rejects.toMatchInlineSnapshot(`[TypeError: Cannot read property 'indexOf' of undefined]`);
 
       expect(mockEsClient.clearScroll).toHaveBeenCalledWith(
         expect.objectContaining({ body: { scroll_id: lastScrollId } })
@@ -322,7 +334,8 @@ describe('CSV Execute Job', function () {
       const { csv_contains_formulas: csvContainsFormulas } = await runTask(
         'job123',
         jobParams,
-        cancellationToken
+        cancellationToken,
+        stream
       );
 
       expect(csvContainsFormulas).toEqual(true);
@@ -349,7 +362,8 @@ describe('CSV Execute Job', function () {
       const { csv_contains_formulas: csvContainsFormulas } = await runTask(
         'job123',
         jobParams,
-        cancellationToken
+        cancellationToken,
+        stream
       );
 
       expect(csvContainsFormulas).toEqual(true);
@@ -377,7 +391,8 @@ describe('CSV Execute Job', function () {
       const { csv_contains_formulas: csvContainsFormulas } = await runTask(
         'job123',
         jobParams,
-        cancellationToken
+        cancellationToken,
+        stream
       );
 
       expect(csvContainsFormulas).toEqual(false);
@@ -406,7 +421,8 @@ describe('CSV Execute Job', function () {
       const { csv_contains_formulas: csvContainsFormulas } = await runTask(
         'job123',
         jobParams,
-        cancellationToken
+        cancellationToken,
+        stream
       );
 
       expect(csvContainsFormulas).toEqual(false);
@@ -433,7 +449,8 @@ describe('CSV Execute Job', function () {
       const { csv_contains_formulas: csvContainsFormulas } = await runTask(
         'job123',
         jobParams,
-        cancellationToken
+        cancellationToken,
+        stream
       );
 
       expect(csvContainsFormulas).toEqual(false);
@@ -459,7 +476,7 @@ describe('CSV Execute Job', function () {
         conflictedTypesFields: [],
         searchRequest: { index: null, body: null },
       });
-      const { content } = await runTask('job123', jobParams, cancellationToken);
+      await runTask('job123', jobParams, cancellationToken, stream);
 
       expect(content).toEqual(`${CSV_BOM_CHARS}one,two\none,bar\n`);
     });
@@ -482,7 +499,7 @@ describe('CSV Execute Job', function () {
         conflictedTypesFields: [],
         searchRequest: { index: null, body: null },
       });
-      const { content } = await runTask('job123', jobParams, cancellationToken);
+      await runTask('job123', jobParams, cancellationToken, stream);
 
       expect(content).toEqual('one,two\none,bar\n');
     });
@@ -507,7 +524,7 @@ describe('CSV Execute Job', function () {
         conflictedTypesFields: [],
         searchRequest: { index: null, body: null },
       });
-      const { content } = await runTask('job123', jobParams, cancellationToken);
+      await runTask('job123', jobParams, cancellationToken, stream);
 
       expect(content).toEqual("one,two\n\"'=cmd|' /C calc'!A0\",bar\n");
     });
@@ -530,7 +547,7 @@ describe('CSV Execute Job', function () {
         conflictedTypesFields: [],
         searchRequest: { index: null, body: null },
       });
-      const { content } = await runTask('job123', jobParams, cancellationToken);
+      await runTask('job123', jobParams, cancellationToken, stream);
 
       expect(content).toEqual('one,two\n"=cmd|\' /C calc\'!A0",bar\n');
     });
@@ -545,9 +562,9 @@ describe('CSV Execute Job', function () {
         fields: [],
         searchRequest: { index: null, body: null },
       });
-      await expect(runTask('job123', jobParams, cancellationToken)).rejects.toMatchInlineSnapshot(
-        `[Error]`
-      );
+      await expect(
+        runTask('job123', jobParams, cancellationToken, stream)
+      ).rejects.toMatchInlineSnapshot(`[Error]`);
     });
 
     it('should reject Promise if scroll call errors out', async function () {
@@ -566,9 +583,9 @@ describe('CSV Execute Job', function () {
         fields: [],
         searchRequest: { index: null, body: null },
       });
-      await expect(runTask('job123', jobParams, cancellationToken)).rejects.toMatchInlineSnapshot(
-        `[Error]`
-      );
+      await expect(
+        runTask('job123', jobParams, cancellationToken, stream)
+      ).rejects.toMatchInlineSnapshot(`[Error]`);
     });
   });
 
@@ -589,7 +606,9 @@ describe('CSV Execute Job', function () {
         fields: [],
         searchRequest: { index: null, body: null },
       });
-      await expect(runTask('job123', jobParams, cancellationToken)).rejects.toMatchInlineSnapshot(
+      await expect(
+        runTask('job123', jobParams, cancellationToken, stream)
+      ).rejects.toMatchInlineSnapshot(
         `[Error: Expected _scroll_id in the following Elasticsearch response: {"hits":{"hits":[{}]}}]`
       );
     });
@@ -610,7 +629,9 @@ describe('CSV Execute Job', function () {
         fields: [],
         searchRequest: { index: null, body: null },
       });
-      await expect(runTask('job123', jobParams, cancellationToken)).rejects.toMatchInlineSnapshot(
+      await expect(
+        runTask('job123', jobParams, cancellationToken, stream)
+      ).rejects.toMatchInlineSnapshot(
         `[Error: Expected _scroll_id in the following Elasticsearch response: {"hits":{"hits":[]}}]`
       );
     });
@@ -640,7 +661,9 @@ describe('CSV Execute Job', function () {
         fields: [],
         searchRequest: { index: null, body: null },
       });
-      await expect(runTask('job123', jobParams, cancellationToken)).rejects.toMatchInlineSnapshot(
+      await expect(
+        runTask('job123', jobParams, cancellationToken, stream)
+      ).rejects.toMatchInlineSnapshot(
         `[Error: Expected _scroll_id in the following Elasticsearch response: {"hits":{"hits":[{}]}}]`
       );
     });
@@ -670,7 +693,9 @@ describe('CSV Execute Job', function () {
         fields: [],
         searchRequest: { index: null, body: null },
       });
-      await expect(runTask('job123', jobParams, cancellationToken)).rejects.toMatchInlineSnapshot(
+      await expect(
+        runTask('job123', jobParams, cancellationToken, stream)
+      ).rejects.toMatchInlineSnapshot(
         `[Error: Expected _scroll_id in the following Elasticsearch response: {"hits":{"hits":[]}}]`
       );
     });
@@ -705,7 +730,8 @@ describe('CSV Execute Job', function () {
           fields: [],
           searchRequest: { index: null, body: null },
         }),
-        cancellationToken
+        cancellationToken,
+        stream
       );
 
       await delay(250);
@@ -729,7 +755,8 @@ describe('CSV Execute Job', function () {
           fields: [],
           searchRequest: { index: null, body: null },
         }),
-        cancellationToken
+        cancellationToken,
+        stream
       );
       cancellationToken.cancel();
 
@@ -745,7 +772,8 @@ describe('CSV Execute Job', function () {
           fields: [],
           searchRequest: { index: null, body: null },
         }),
-        cancellationToken
+        cancellationToken,
+        stream
       );
       await delay(100);
       cancellationToken.cancel();
@@ -767,7 +795,7 @@ describe('CSV Execute Job', function () {
         fields: ['one', 'two'],
         searchRequest: { index: null, body: null },
       });
-      const { content } = await runTask('job123', jobParams, cancellationToken);
+      await runTask('job123', jobParams, cancellationToken, stream);
       expect(content).toBe(`one,two\n`);
     });
 
@@ -779,7 +807,7 @@ describe('CSV Execute Job', function () {
         fields: ['one', 'two'],
         searchRequest: { index: null, body: null },
       });
-      const { content } = await runTask('job123', jobParams, cancellationToken);
+      await runTask('job123', jobParams, cancellationToken, stream);
       expect(content).toBe(`one;two\n`);
     });
 
@@ -791,7 +819,7 @@ describe('CSV Execute Job', function () {
         fields: ['one and a half', 'two', 'three-and-four', 'five & six'],
         searchRequest: { index: null, body: null },
       });
-      const { content } = await runTask('job123', jobParams, cancellationToken);
+      await runTask('job123', jobParams, cancellationToken, stream);
       expect(content).toBe(`"one and a half",two,"three-and-four","five & six"\n`);
     });
 
@@ -803,7 +831,7 @@ describe('CSV Execute Job', function () {
         fields: ['one and a half', 'two', 'three-and-four', 'five & six'],
         searchRequest: { index: null, body: null },
       });
-      const { content } = await runTask('job123', jobParams, cancellationToken);
+      await runTask('job123', jobParams, cancellationToken, stream);
       expect(content).toBe(`one and a half,two,three-and-four,five & six\n`);
     });
 
@@ -823,7 +851,7 @@ describe('CSV Execute Job', function () {
         fields: ['one', 'two'],
         searchRequest: { index: null, body: null },
       });
-      const { content } = await runTask('job123', jobParams, cancellationToken);
+      await runTask('job123', jobParams, cancellationToken, stream);
       expect(content).not.toBe(null);
       const lines = content!.split('\n');
       const headerLine = lines[0];
@@ -847,7 +875,7 @@ describe('CSV Execute Job', function () {
         conflictedTypesFields: [],
         searchRequest: { index: null, body: null },
       });
-      const { content } = await runTask('job123', jobParams, cancellationToken);
+      await runTask('job123', jobParams, cancellationToken, stream);
       expect(content).not.toBe(null);
       const lines = content!.split('\n');
       const valuesLine = lines[1];
@@ -879,7 +907,7 @@ describe('CSV Execute Job', function () {
         conflictedTypesFields: [],
         searchRequest: { index: null, body: null },
       });
-      const { content } = await runTask('job123', jobParams, cancellationToken);
+      await runTask('job123', jobParams, cancellationToken, stream);
       expect(content).not.toBe(null);
       const lines = content!.split('\n');
 
@@ -913,7 +941,7 @@ describe('CSV Execute Job', function () {
           },
         },
       });
-      const { content } = await runTask('job123', jobParams, cancellationToken);
+      await runTask('job123', jobParams, cancellationToken, stream);
       expect(content).not.toBe(null);
       const lines = content!.split('\n');
 
@@ -927,7 +955,6 @@ describe('CSV Execute Job', function () {
     // tests use these 'simple' characters to make the math easier
 
     describe('when only the headers exceed the maxSizeBytes', function () {
-      let content: string | null;
       let maxSizeReached: boolean | undefined;
 
       beforeEach(async function () {
@@ -940,10 +967,11 @@ describe('CSV Execute Job', function () {
           searchRequest: { index: null, body: null },
         });
 
-        ({ content, max_size_reached: maxSizeReached } = await runTask(
+        ({ max_size_reached: maxSizeReached } = await runTask(
           'job123',
           jobParams,
-          cancellationToken
+          cancellationToken,
+          stream
         ));
       });
 
@@ -957,7 +985,6 @@ describe('CSV Execute Job', function () {
     });
 
     describe('when headers are equal to maxSizeBytes', function () {
-      let content: string | null;
       let maxSizeReached: boolean | undefined;
 
       beforeEach(async function () {
@@ -970,10 +997,11 @@ describe('CSV Execute Job', function () {
           searchRequest: { index: null, body: null },
         });
 
-        ({ content, max_size_reached: maxSizeReached } = await runTask(
+        ({ max_size_reached: maxSizeReached } = await runTask(
           'job123',
           jobParams,
-          cancellationToken
+          cancellationToken,
+          stream
         ));
       });
 
@@ -987,7 +1015,6 @@ describe('CSV Execute Job', function () {
     });
 
     describe('when the data exceeds the maxSizeBytes', function () {
-      let content: string | null;
       let maxSizeReached: boolean | undefined;
 
       beforeEach(async function () {
@@ -1010,10 +1037,11 @@ describe('CSV Execute Job', function () {
           searchRequest: { index: null, body: null },
         });
 
-        ({ content, max_size_reached: maxSizeReached } = await runTask(
+        ({ max_size_reached: maxSizeReached } = await runTask(
           'job123',
           jobParams,
-          cancellationToken
+          cancellationToken,
+          stream
         ));
       });
 
@@ -1027,7 +1055,6 @@ describe('CSV Execute Job', function () {
     });
 
     describe('when headers and data equal the maxSizeBytes', function () {
-      let content: string | null;
       let maxSizeReached: boolean | undefined;
 
       beforeEach(async function () {
@@ -1052,10 +1079,11 @@ describe('CSV Execute Job', function () {
           searchRequest: { index: null, body: null },
         });
 
-        ({ content, max_size_reached: maxSizeReached } = await runTask(
+        ({ max_size_reached: maxSizeReached } = await runTask(
           'job123',
           jobParams,
-          cancellationToken
+          cancellationToken,
+          stream
         ));
       });
 
@@ -1091,7 +1119,7 @@ describe('CSV Execute Job', function () {
         searchRequest: { index: null, body: null },
       });
 
-      await runTask('job123', jobParams, cancellationToken);
+      await runTask('job123', jobParams, cancellationToken, stream);
 
       expect(mockEsClient.search).toHaveBeenCalledWith(
         expect.objectContaining({ scroll: scrollDuration })
@@ -1119,7 +1147,7 @@ describe('CSV Execute Job', function () {
         searchRequest: { index: null, body: null },
       });
 
-      await runTask('job123', jobParams, cancellationToken);
+      await runTask('job123', jobParams, cancellationToken, stream);
 
       expect(mockEsClient.search).toHaveBeenCalledWith(
         expect.objectContaining({ size: scrollSize })
@@ -1147,7 +1175,7 @@ describe('CSV Execute Job', function () {
         searchRequest: { index: null, body: null },
       });
 
-      await runTask('job123', jobParams, cancellationToken);
+      await runTask('job123', jobParams, cancellationToken, stream);
 
       expect(mockEsClient.scroll).toHaveBeenCalledWith(
         expect.objectContaining({ body: { scroll: scrollDuration, scroll_id: 'scrollId' } })
diff --git a/x-pack/plugins/reporting/server/export_types/csv/execute_job.ts b/x-pack/plugins/reporting/server/export_types/csv/execute_job.ts
index 57559d136ff3e5..322cde38d7fd63 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/execute_job.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/execute_job.ts
@@ -16,7 +16,7 @@ export const runTaskFnFactory: RunTaskFnFactory<
 > = function executeJobFactoryFn(reporting, parentLogger) {
   const config = reporting.getConfig();
 
-  return async function runTask(jobId, job, cancellationToken) {
+  return async function runTask(jobId, job, cancellationToken, stream) {
     const elasticsearch = await reporting.getEsClient();
     const logger = parentLogger.clone([jobId]);
     const generateCsv = createGenerateCsv(logger);
@@ -27,18 +27,18 @@ export const runTaskFnFactory: RunTaskFnFactory<
     const uiSettingsClient = await reporting.getUiSettingsClient(fakeRequest, logger);
     const { asCurrentUser: elasticsearchClient } = elasticsearch.asScoped(fakeRequest);
 
-    const { content, maxSizeReached, size, csvContainsFormulas, warnings } = await generateCsv(
+    const { maxSizeReached, size, csvContainsFormulas, warnings } = await generateCsv(
       job,
       config,
       uiSettingsClient,
       elasticsearchClient,
-      cancellationToken
+      cancellationToken,
+      stream
     );
 
     // @TODO: Consolidate these one-off warnings into the warnings array (max-size reached and csv contains formulas)
     return {
       content_type: CONTENT_TYPE_CSV,
-      content,
       max_size_reached: maxSizeReached,
       size,
       csv_contains_formulas: csvContainsFormulas,
diff --git a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/field_format_map.test.ts b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/field_format_map.test.ts
index ed303fb0c27bd4..6e1ad21397e73a 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/field_format_map.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/field_format_map.test.ts
@@ -6,7 +6,13 @@
  */
 
 import expect from '@kbn/expect';
-import { fieldFormats, FieldFormatsGetConfigFn, UI_SETTINGS } from 'src/plugins/data/server';
+import {
+  FieldFormatsGetConfigFn,
+  FieldFormatsRegistry,
+  BytesFormat,
+  NumberFormat,
+  FORMATS_UI_SETTINGS,
+} from 'src/plugins/field_formats/common';
 import { IndexPatternSavedObjectDeprecatedCSV } from '../types';
 import { fieldFormatMapFactory } from './field_format_map';
 
@@ -22,16 +28,16 @@ describe('field format map', function () {
     },
   };
   const configMock: Record<string, ConfigValue> = {};
-  configMock[UI_SETTINGS.FORMAT_DEFAULT_TYPE_MAP] = {
+  configMock[FORMATS_UI_SETTINGS.FORMAT_DEFAULT_TYPE_MAP] = {
     number: { id: 'number', params: {} },
   };
-  configMock[UI_SETTINGS.FORMAT_NUMBER_DEFAULT_PATTERN] = '0,0.[000]';
+  configMock[FORMATS_UI_SETTINGS.FORMAT_NUMBER_DEFAULT_PATTERN] = '0,0.[000]';
   const getConfig = ((key: string) => configMock[key]) as FieldFormatsGetConfigFn;
   const testValue = '4000';
   const mockTimezone = 'Browser';
 
-  const fieldFormatsRegistry = new fieldFormats.FieldFormatsRegistry();
-  fieldFormatsRegistry.init(getConfig, {}, [fieldFormats.BytesFormat, fieldFormats.NumberFormat]);
+  const fieldFormatsRegistry = new FieldFormatsRegistry();
+  fieldFormatsRegistry.init(getConfig, {}, [BytesFormat, NumberFormat]);
 
   const formatMap = fieldFormatMapFactory(
     indexPatternSavedObject,
diff --git a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/field_format_map.ts b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/field_format_map.ts
index e5508f42f8c0d6..9d094f4308ed73 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/field_format_map.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/field_format_map.ts
@@ -6,8 +6,11 @@
  */
 
 import _ from 'lodash';
-import { FieldFormat } from 'src/plugins/data/common';
-import { FieldFormatConfig, IFieldFormatsRegistry } from 'src/plugins/data/server';
+import {
+  FieldFormat,
+  IFieldFormatsRegistry,
+  FieldFormatConfig,
+} from 'src/plugins/field_formats/common';
 import { IndexPatternSavedObjectDeprecatedCSV } from '../types';
 
 /**
diff --git a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/format_csv_values.ts b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/format_csv_values.ts
index 440dcc69b1c730..006aa41c6a35e4 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/format_csv_values.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/format_csv_values.ts
@@ -6,7 +6,7 @@
  */
 
 import { isNull, isObject, isUndefined } from 'lodash';
-import { FieldFormat } from 'src/plugins/data/common';
+import { FieldFormat } from 'src/plugins/field_formats/common';
 import { RawValue } from '../types';
 
 export function createFormatCsvValues(
diff --git a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/index.ts b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/index.ts
index c1018030827c06..9dfc32b90e8c57 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/generate_csv/index.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/generate_csv/index.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { Writable } from 'stream';
 import { i18n } from '@kbn/i18n';
 import { ElasticsearchClient, IUiSettingsClient } from 'src/core/server';
 import { ReportingConfig } from '../../../';
@@ -57,12 +58,17 @@ export function createGenerateCsv(logger: LevelLogger) {
     config: ReportingConfig,
     uiSettingsClient: IUiSettingsClient,
     elasticsearchClient: ElasticsearchClient,
-    cancellationToken: CancellationToken
+    cancellationToken: CancellationToken,
+    stream: Writable
   ): Promise<SavedSearchGeneratorResultDeprecatedCSV> {
     const settings = await getUiSettings(job.browserTimezone, uiSettingsClient, config, logger);
     const escapeValue = createEscapeValue(settings.quoteValues, settings.escapeFormulaValues);
     const bom = config.get('csv', 'useByteOrderMarkEncoding') ? CSV_BOM_CHARS : '';
-    const builder = new MaxSizeStringBuilder(byteSizeValueToNumber(settings.maxSizeBytes), bom);
+    const builder = new MaxSizeStringBuilder(
+      stream,
+      byteSizeValueToNumber(settings.maxSizeBytes),
+      bom
+    );
 
     const { fields, metaFields, conflictedTypesFields } = job;
     const header = `${fields.map(escapeValue).join(settings.separator)}\n`;
@@ -71,7 +77,6 @@ export function createGenerateCsv(logger: LevelLogger) {
     if (!builder.tryAppend(header)) {
       return {
         size: 0,
-        content: '',
         maxSizeReached: true,
         warnings: [],
       };
@@ -148,7 +153,6 @@ export function createGenerateCsv(logger: LevelLogger) {
     }
 
     return {
-      content: builder.getString(),
       csvContainsFormulas: csvContainsFormulas && !settings.escapeFormulaValues,
       maxSizeReached,
       size,
diff --git a/x-pack/plugins/reporting/server/export_types/csv/types.d.ts b/x-pack/plugins/reporting/server/export_types/csv/types.d.ts
index 604d451d822b61..8ba87445efd9d2 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/types.d.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv/types.d.ts
@@ -78,7 +78,6 @@ type FormatsMapDeprecatedCSV = Map<
 >;
 
 export interface SavedSearchGeneratorResultDeprecatedCSV {
-  content: string;
   size: number;
   maxSizeReached: boolean;
   csvContainsFormulas?: boolean;
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource/execute_job.test.ts b/x-pack/plugins/reporting/server/export_types/csv_searchsource/execute_job.test.ts
index b96828bb06334c..497a01d2587ad2 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_searchsource/execute_job.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv_searchsource/execute_job.test.ts
@@ -9,12 +9,14 @@ jest.mock('./generate_csv/generate_csv', () => ({
   CsvGenerator: class CsvGeneratorMock {
     generateData() {
       return {
-        content: 'test\n123',
+        size: 123,
+        content_type: 'text/csv',
       };
     }
   },
 }));
 
+import { Writable } from 'stream';
 import nodeCrypto from '@elastic/node-crypto';
 import { ReportingCore } from '../../';
 import { CancellationToken } from '../../../common';
@@ -30,6 +32,7 @@ const encryptionKey = 'tetkey';
 const headers = { sid: 'cooltestheaders' };
 let encryptedHeaders: string;
 let reportingCore: ReportingCore;
+let stream: jest.Mocked<Writable>;
 
 beforeAll(async () => {
   const crypto = nodeCrypto({ encryptionKey });
@@ -48,6 +51,10 @@ beforeAll(async () => {
   );
 });
 
+beforeEach(() => {
+  stream = {} as typeof stream;
+});
+
 test('gets the csv content from job parameters', async () => {
   const runTask = runTaskFnFactory(reportingCore, logger);
 
@@ -61,13 +68,14 @@ test('gets the csv content from job parameters', async () => {
       title: 'Test Search',
       version: '7.13.0',
     },
-    new CancellationToken()
+    new CancellationToken(),
+    stream
   );
 
   expect(payload).toMatchInlineSnapshot(`
     Object {
-      "content": "test
-    123",
+      "content_type": "text/csv",
+      "size": 123,
     }
   `);
 });
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource/execute_job.ts b/x-pack/plugins/reporting/server/export_types/csv_searchsource/execute_job.ts
index ff50377ab13c5f..97f0aa65e3d68e 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_searchsource/execute_job.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv_searchsource/execute_job.ts
@@ -18,7 +18,7 @@ export const runTaskFnFactory: RunTaskFnFactory<RunTaskFn<TaskPayloadCSV>> = (
 ) => {
   const config = reporting.getConfig();
 
-  return async function runTask(jobId, job, cancellationToken) {
+  return async function runTask(jobId, job, cancellationToken, stream) {
     const logger = parentLogger.clone([CSV_JOB_TYPE, 'execute-job', jobId]);
 
     const encryptionKey = config.get('encryptionKey');
@@ -43,7 +43,15 @@ export const runTaskFnFactory: RunTaskFnFactory<RunTaskFn<TaskPayloadCSV>> = (
       fieldFormatsRegistry,
     };
 
-    const csv = new CsvGenerator(job, config, clients, dependencies, cancellationToken, logger);
+    const csv = new CsvGenerator(
+      job,
+      config,
+      clients,
+      dependencies,
+      cancellationToken,
+      logger,
+      stream
+    );
     return await csv.generateData();
   };
 };
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.test.ts b/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.test.ts
index 596cb5a3144144..87512005044059 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.test.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { Writable } from 'stream';
 import * as Rx from 'rxjs';
 import { identity, range } from 'lodash';
 import { IScopedClusterClient, IUiSettingsClient, SearchResponse } from 'src/core/server';
@@ -13,7 +14,8 @@ import {
   savedObjectsClientMock,
   uiSettingsServiceMock,
 } from 'src/core/server/mocks';
-import { FieldFormatsRegistry, ISearchStartSearchSource } from 'src/plugins/data/common';
+import { ISearchStartSearchSource } from 'src/plugins/data/common';
+import { FieldFormatsRegistry } from 'src/plugins/field_formats/common';
 import { searchSourceInstanceMock } from 'src/plugins/data/common/search/search_source/mocks';
 import { IScopedSearchClient } from 'src/plugins/data/server';
 import { dataPluginMock } from 'src/plugins/data/server/mocks';
@@ -40,6 +42,8 @@ let mockEsClient: IScopedClusterClient;
 let mockDataClient: IScopedSearchClient;
 let mockConfig: ReportingConfig;
 let uiSettingsClient: IUiSettingsClient;
+let stream: jest.Mocked<Writable>;
+let content: string;
 
 const searchSourceMock = { ...searchSourceInstanceMock };
 const mockSearchSourceService: jest.Mocked<ISearchStartSearchSource> = {
@@ -83,6 +87,8 @@ const mockFieldFormatsRegistry = ({
 } as unknown) as FieldFormatsRegistry;
 
 beforeEach(async () => {
+  content = '';
+  stream = ({ write: jest.fn((chunk) => (content += chunk)) } as unknown) as typeof stream;
   mockEsClient = elasticsearchServiceMock.createScopedClusterClient();
   mockDataClient = dataPluginMock.createStartContract().search.asScoped({} as any);
   mockDataClient.search = mockDataClientSearchDefault;
@@ -131,10 +137,11 @@ it('formats an empty search result to CSV content', async () => {
       fieldFormatsRegistry: mockFieldFormatsRegistry,
     },
     new CancellationToken(),
-    logger
+    logger,
+    stream
   );
   const csvResult = await generateCsv.generateData();
-  expect(csvResult.content).toMatchSnapshot();
+  expect(content).toMatchSnapshot();
   expect(csvResult.csv_contains_formulas).toBe(false);
 });
 
@@ -170,10 +177,11 @@ it('formats a search result to CSV content', async () => {
       fieldFormatsRegistry: mockFieldFormatsRegistry,
     },
     new CancellationToken(),
-    logger
+    logger,
+    stream
   );
   const csvResult = await generateCsv.generateData();
-  expect(csvResult.content).toMatchSnapshot();
+  expect(content).toMatchSnapshot();
   expect(csvResult.csv_contains_formulas).toBe(false);
 });
 
@@ -214,7 +222,8 @@ it('calculates the bytes of the content', async () => {
       fieldFormatsRegistry: mockFieldFormatsRegistry,
     },
     new CancellationToken(),
-    logger
+    logger,
+    stream
   );
   const csvResult = await generateCsv.generateData();
   expect(csvResult.size).toBe(2608);
@@ -266,12 +275,13 @@ it('warns if max size was reached', async () => {
       fieldFormatsRegistry: mockFieldFormatsRegistry,
     },
     new CancellationToken(),
-    logger
+    logger,
+    stream
   );
   const csvResult = await generateCsv.generateData();
   expect(csvResult.max_size_reached).toBe(true);
   expect(csvResult.warnings).toEqual([]);
-  expect(csvResult.content).toMatchSnapshot();
+  expect(content).toMatchSnapshot();
 });
 
 it('uses the scrollId to page all the data', async () => {
@@ -319,11 +329,12 @@ it('uses the scrollId to page all the data', async () => {
       fieldFormatsRegistry: mockFieldFormatsRegistry,
     },
     new CancellationToken(),
-    logger
+    logger,
+    stream
   );
   const csvResult = await generateCsv.generateData();
   expect(csvResult.warnings).toEqual([]);
-  expect(csvResult.content).toMatchSnapshot();
+  expect(content).toMatchSnapshot();
 
   expect(mockDataClient.search).toHaveBeenCalledTimes(1);
   expect(mockDataClient.search).toBeCalledWith(
@@ -384,11 +395,12 @@ describe('fields from job.searchSource.getFields() (7.12 generated)', () => {
         fieldFormatsRegistry: mockFieldFormatsRegistry,
       },
       new CancellationToken(),
-      logger
+      logger,
+      stream
     );
-    const csvResult = await generateCsv.generateData();
+    await generateCsv.generateData();
 
-    expect(csvResult.content).toMatchSnapshot();
+    expect(content).toMatchSnapshot();
   });
 
   it('provides top-level underscored fields as columns', async () => {
@@ -440,12 +452,13 @@ describe('fields from job.searchSource.getFields() (7.12 generated)', () => {
         fieldFormatsRegistry: mockFieldFormatsRegistry,
       },
       new CancellationToken(),
-      logger
+      logger,
+      stream
     );
 
     const csvResult = await generateCsv.generateData();
 
-    expect(csvResult.content).toMatchSnapshot();
+    expect(content).toMatchSnapshot();
     expect(csvResult.csv_contains_formulas).toBe(false);
   });
 
@@ -504,12 +517,13 @@ describe('fields from job.searchSource.getFields() (7.12 generated)', () => {
         fieldFormatsRegistry: mockFieldFormatsRegistry,
       },
       new CancellationToken(),
-      logger
+      logger,
+      stream
     );
 
     const csvResult = await generateCsv.generateData();
 
-    expect(csvResult.content).toMatchSnapshot();
+    expect(content).toMatchSnapshot();
     expect(csvResult.csv_contains_formulas).toBe(false);
   });
 });
@@ -550,11 +564,12 @@ describe('fields from job.columns (7.13+ generated)', () => {
         fieldFormatsRegistry: mockFieldFormatsRegistry,
       },
       new CancellationToken(),
-      logger
+      logger,
+      stream
     );
-    const csvResult = await generateCsv.generateData();
+    await generateCsv.generateData();
 
-    expect(csvResult.content).toMatchSnapshot();
+    expect(content).toMatchSnapshot();
   });
 
   it('columns can be top-level fields such as _id and _index', async () => {
@@ -592,11 +607,12 @@ describe('fields from job.columns (7.13+ generated)', () => {
         fieldFormatsRegistry: mockFieldFormatsRegistry,
       },
       new CancellationToken(),
-      logger
+      logger,
+      stream
     );
-    const csvResult = await generateCsv.generateData();
+    await generateCsv.generateData();
 
-    expect(csvResult.content).toMatchSnapshot();
+    expect(content).toMatchSnapshot();
   });
 
   it('empty columns defaults to using searchSource.getFields()', async () => {
@@ -640,11 +656,12 @@ describe('fields from job.columns (7.13+ generated)', () => {
         fieldFormatsRegistry: mockFieldFormatsRegistry,
       },
       new CancellationToken(),
-      logger
+      logger,
+      stream
     );
-    const csvResult = await generateCsv.generateData();
+    await generateCsv.generateData();
 
-    expect(csvResult.content).toMatchSnapshot();
+    expect(content).toMatchSnapshot();
   });
 });
 
@@ -684,12 +701,13 @@ describe('formulas', () => {
         fieldFormatsRegistry: mockFieldFormatsRegistry,
       },
       new CancellationToken(),
-      logger
+      logger,
+      stream
     );
 
     const csvResult = await generateCsv.generateData();
 
-    expect(csvResult.content).toMatchSnapshot();
+    expect(content).toMatchSnapshot();
     expect(csvResult.csv_contains_formulas).toBe(false);
   });
 
@@ -733,12 +751,13 @@ describe('formulas', () => {
         fieldFormatsRegistry: mockFieldFormatsRegistry,
       },
       new CancellationToken(),
-      logger
+      logger,
+      stream
     );
 
     const csvResult = await generateCsv.generateData();
 
-    expect(csvResult.content).toMatchSnapshot();
+    expect(content).toMatchSnapshot();
     expect(csvResult.csv_contains_formulas).toBe(false);
   });
 
@@ -785,12 +804,13 @@ describe('formulas', () => {
         fieldFormatsRegistry: mockFieldFormatsRegistry,
       },
       new CancellationToken(),
-      logger
+      logger,
+      stream
     );
 
     const csvResult = await generateCsv.generateData();
 
-    expect(csvResult.content).toMatchSnapshot();
+    expect(content).toMatchSnapshot();
     expect(csvResult.csv_contains_formulas).toBe(true);
   });
 });
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.ts b/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.ts
index 7eaf1ef95c1493..8488b54b77f00a 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/generate_csv.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { Writable } from 'stream';
 import { i18n } from '@kbn/i18n';
 import type { estypes } from '@elastic/elasticsearch';
 import { IScopedClusterClient, IUiSettingsClient } from 'src/core/server';
@@ -14,9 +15,6 @@ import { ReportingConfig } from '../../..';
 import {
   cellHasFormulas,
   ES_SEARCH_STRATEGY,
-  FieldFormat,
-  FieldFormatConfig,
-  IFieldFormatsRegistry,
   IndexPattern,
   ISearchSource,
   ISearchStartSearchSource,
@@ -24,6 +22,11 @@ import {
   SearchSourceFields,
   tabifyDocs,
 } from '../../../../../../../src/plugins/data/common';
+import {
+  FieldFormat,
+  FieldFormatConfig,
+  IFieldFormatsRegistry,
+} from '../../../../../../../src/plugins/field_formats/common';
 import { KbnServerError } from '../../../../../../../src/plugins/kibana_utils/server';
 import { CancellationToken } from '../../../../common';
 import { CONTENT_TYPE_CSV } from '../../../../common/constants';
@@ -73,7 +76,8 @@ export class CsvGenerator {
     private clients: Clients,
     private dependencies: Dependencies,
     private cancellationToken: CancellationToken,
-    private logger: LevelLogger
+    private logger: LevelLogger,
+    private stream: Writable
   ) {}
 
   private async scan(
@@ -290,7 +294,7 @@ export class CsvGenerator {
 
     const { maxSizeBytes, bom, escapeFormulaValues, scroll: scrollSettings } = settings;
 
-    const builder = new MaxSizeStringBuilder(byteSizeValueToNumber(maxSizeBytes), bom);
+    const builder = new MaxSizeStringBuilder(this.stream, byteSizeValueToNumber(maxSizeBytes), bom);
     const warnings: string[] = [];
     let first = true;
     let currentRecord = -1;
@@ -403,7 +407,6 @@ export class CsvGenerator {
     );
 
     return {
-      content: builder.getString(),
       content_type: CONTENT_TYPE_CSV,
       csv_contains_formulas: this.csvContainsFormulas && !escapeFormulaValues,
       max_size_reached: this.maxSizeReached,
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/max_size_string_builder.test.ts b/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/max_size_string_builder.test.ts
index b0340a53fd6034..27d3719f71f931 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/max_size_string_builder.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/max_size_string_builder.test.ts
@@ -5,85 +5,86 @@
  * 2.0.
  */
 
-import expect from '@kbn/expect';
+import { Writable } from 'stream';
 import { MaxSizeStringBuilder } from './max_size_string_builder';
 
+let content: string;
+let stream: jest.Mocked<Writable>;
+
 describe('MaxSizeStringBuilder', function () {
+  beforeEach(() => {
+    content = '';
+    stream = ({ write: jest.fn((chunk) => (content += chunk)) } as unknown) as typeof stream;
+  });
+
   describe('tryAppend', function () {
     it(`should return true if appended string is under maxSize`, function () {
-      const builder = new MaxSizeStringBuilder(100);
+      const builder = new MaxSizeStringBuilder(stream, 100);
       const result = builder.tryAppend('aa');
-      expect(result).to.be(true);
+      expect(result).toBe(true);
     });
 
     it(`should return false if appended string is over the maxSize`, function () {
-      const builder = new MaxSizeStringBuilder(1);
+      const builder = new MaxSizeStringBuilder(stream, 1);
       const result = builder.tryAppend('aa');
-      expect(result).to.be(false);
+      expect(result).toBe(false);
     });
 
     it(`should return true then false if second appended string puts total size over the maxSize`, function () {
-      const builder = new MaxSizeStringBuilder(1);
-      expect(builder.tryAppend('a')).to.be(true);
-      expect(builder.tryAppend('a')).to.be(false);
-    });
-  });
-
-  describe('getBuffer', function () {
-    it(`should return an empty string when we don't call tryAppend`, function () {
-      const builder = new MaxSizeStringBuilder(100);
-      expect(builder.getString()).to.be('');
+      const builder = new MaxSizeStringBuilder(stream, 1);
+      expect(builder.tryAppend('a')).toBe(true);
+      expect(builder.tryAppend('a')).toBe(false);
     });
 
-    it('should return equivalent string if tryAppend called once and less than maxSize', function () {
+    it('should write equivalent string if called once and less than maxSize', function () {
       const str = 'foo';
-      const builder = new MaxSizeStringBuilder(100);
+      const builder = new MaxSizeStringBuilder(stream, 100);
       builder.tryAppend(str);
-      expect(builder.getString()).to.be(str);
+      expect(content).toBe(str);
     });
 
-    it('should return equivalent string if tryAppend called multiple times and total size less than maxSize', function () {
+    it('should write equivalent string if called multiple times and total size less than maxSize', function () {
       const strs = ['foo', 'bar', 'baz'];
-      const builder = new MaxSizeStringBuilder(100);
+      const builder = new MaxSizeStringBuilder(stream, 100);
       strs.forEach((str) => builder.tryAppend(str));
-      expect(builder.getString()).to.be(strs.join(''));
+      expect(content).toBe(strs.join(''));
     });
 
-    it('should return empty string if tryAppend called one time with size greater than maxSize', function () {
+    it('should write empty string if called one time with size greater than maxSize', function () {
       const str = 'aa'; // each a is one byte
-      const builder = new MaxSizeStringBuilder(1);
+      const builder = new MaxSizeStringBuilder(stream, 1);
       builder.tryAppend(str);
-      expect(builder.getString()).to.be('');
+      expect(content).toBe('');
     });
 
-    it('should return partial string if tryAppend called multiple times with total size greater than maxSize', function () {
+    it('should write partial string if called multiple times with total size greater than maxSize', function () {
       const str = 'a'; // each a is one byte
-      const builder = new MaxSizeStringBuilder(1);
+      const builder = new MaxSizeStringBuilder(stream, 1);
       builder.tryAppend(str);
       builder.tryAppend(str);
-      expect(builder.getString()).to.be('a');
+      expect(content).toBe('a');
     });
 
-    it('should return string with bom character prepended', function () {
+    it('should write string with bom character prepended', function () {
       const str = 'a'; // each a is one byte
-      const builder = new MaxSizeStringBuilder(1, '∆');
+      const builder = new MaxSizeStringBuilder(stream, 1, '∆');
       builder.tryAppend(str);
       builder.tryAppend(str);
-      expect(builder.getString()).to.be('∆a');
+      expect(content).toBe('∆a');
     });
   });
 
   describe('getSizeInBytes', function () {
     it(`should return 0 when no strings have been appended`, function () {
-      const builder = new MaxSizeStringBuilder(100);
-      expect(builder.getSizeInBytes()).to.be(0);
+      const builder = new MaxSizeStringBuilder(stream, 100);
+      expect(builder.getSizeInBytes()).toBe(0);
     });
 
-    it(`should the size in bytes`, function () {
-      const builder = new MaxSizeStringBuilder(100);
+    it(`should return the size in bytes`, function () {
+      const builder = new MaxSizeStringBuilder(stream, 100);
       const stringValue = 'foobar';
       builder.tryAppend(stringValue);
-      expect(builder.getSizeInBytes()).to.be(stringValue.length);
+      expect(builder.getSizeInBytes()).toBe(stringValue.length);
     });
   });
 });
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/max_size_string_builder.ts b/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/max_size_string_builder.ts
index d5954083c5a0f6..945464ac6c01ca 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/max_size_string_builder.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv_searchsource/generate_csv/max_size_string_builder.ts
@@ -5,35 +5,32 @@
  * 2.0.
  */
 
+import { Writable } from 'stream';
+
 export class MaxSizeStringBuilder {
-  private _buffer: Buffer;
-  private _size: number;
-  private _maxSize: number;
-  private _bom: string;
-
-  constructor(maxSizeBytes: number, bom = '') {
-    this._buffer = Buffer.alloc(maxSizeBytes);
-    this._size = 0;
-    this._maxSize = maxSizeBytes;
-    this._bom = bom;
-  }
+  private size = 0;
+  private pristine = true;
+
+  constructor(private stream: Writable, private maxSizeBytes: number, private bom = '') {}
 
-  tryAppend(str: string) {
-    const byteLength = Buffer.byteLength(str);
-    if (this._size + byteLength <= this._maxSize) {
-      this._buffer.write(str, this._size);
-      this._size += byteLength;
-      return true;
+  tryAppend(chunk: string): boolean {
+    const byteLength = Buffer.byteLength(chunk);
+    if (this.size + byteLength > this.maxSizeBytes) {
+      return false;
     }
 
-    return false;
-  }
+    if (this.pristine) {
+      this.stream.write(this.bom);
+      this.pristine = false;
+    }
+
+    this.stream.write(chunk);
+    this.size += byteLength;
 
-  getSizeInBytes() {
-    return this._size;
+    return true;
   }
 
-  getString() {
-    return this._bom + this._buffer.slice(0, this._size).toString();
+  getSizeInBytes(): number {
+    return this.size;
   }
 }
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource_immediate/execute_job.ts b/x-pack/plugins/reporting/server/export_types/csv_searchsource_immediate/execute_job.ts
index e59c38e16ab479..c261fa62d97d4f 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_searchsource_immediate/execute_job.ts
+++ b/x-pack/plugins/reporting/server/export_types/csv_searchsource_immediate/execute_job.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { Writable } from 'stream';
 import { KibanaRequest } from 'src/core/server';
 import { CancellationToken } from '../../../common';
 import { CSV_SEARCHSOURCE_IMMEDIATE_TYPE } from '../../../common/constants';
@@ -22,6 +23,7 @@ export type ImmediateExecuteFn = (
   jobId: null,
   job: JobParamsDownloadCSV,
   context: ReportingRequestHandlerContext,
+  stream: Writable,
   req: KibanaRequest
 ) => Promise<TaskRunResult>;
 
@@ -32,7 +34,7 @@ export const runTaskFnFactory: RunTaskFnFactory<ImmediateExecuteFn> = function e
   const config = reporting.getConfig();
   const logger = parentLogger.clone([CSV_SEARCHSOURCE_IMMEDIATE_TYPE, 'execute-job']);
 
-  return async function runTask(_jobId, immediateJobParams, context, req) {
+  return async function runTask(_jobId, immediateJobParams, context, stream, req) {
     const job = {
       objectType: 'immediate-search',
       ...immediateJobParams,
@@ -58,7 +60,15 @@ export const runTaskFnFactory: RunTaskFnFactory<ImmediateExecuteFn> = function e
     };
     const cancellationToken = new CancellationToken();
 
-    const csv = new CsvGenerator(job, config, clients, dependencies, cancellationToken, logger);
+    const csv = new CsvGenerator(
+      job,
+      config,
+      clients,
+      dependencies,
+      cancellationToken,
+      logger,
+      stream
+    );
     const result = await csv.generateData();
 
     if (result.csv_contains_formulas) {
diff --git a/x-pack/plugins/reporting/server/export_types/png/execute_job/index.test.ts b/x-pack/plugins/reporting/server/export_types/png/execute_job/index.test.ts
index ee264f7c57ff6f..34cfa66ddd5e10 100644
--- a/x-pack/plugins/reporting/server/export_types/png/execute_job/index.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/png/execute_job/index.test.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { Writable } from 'stream';
 import * as Rx from 'rxjs';
 import { ReportingCore } from '../../../';
 import { CancellationToken } from '../../../../common';
@@ -20,7 +21,9 @@ import { runTaskFnFactory } from './';
 
 jest.mock('../lib/generate_png', () => ({ generatePngObservableFactory: jest.fn() }));
 
+let content: string;
 let mockReporting: ReportingCore;
+let stream: jest.Mocked<Writable>;
 
 const cancellationToken = ({
   on: jest.fn(),
@@ -44,6 +47,9 @@ const encryptHeaders = async (headers: Record<string, string>) => {
 const getBasePayload = (baseObj: any) => baseObj as TaskPayloadPNG;
 
 beforeEach(async () => {
+  content = '';
+  stream = ({ write: jest.fn((chunk) => (content += chunk)) } as unknown) as typeof stream;
+
   const mockReportingConfig = createMockConfigSchema({
     index: '.reporting-2018.10.10',
     encryptionKey: mockEncryptionKey,
@@ -75,7 +81,8 @@ test(`passes browserTimezone to generatePng`, async () => {
       browserTimezone,
       headers: encryptedHeaders,
     }),
-    cancellationToken
+    cancellationToken,
+    stream
   );
 
   expect(generatePngObservable.mock.calls).toMatchInlineSnapshot(`
@@ -119,7 +126,8 @@ test(`returns content_type of application/png`, async () => {
   const { content_type: contentType } = await runTask(
     'pngJobId',
     getBasePayload({ relativeUrl: '/app/kibana#/something', headers: encryptedHeaders }),
-    cancellationToken
+    cancellationToken,
+    stream
   );
   expect(contentType).toBe('image/png');
 });
@@ -131,10 +139,11 @@ test(`returns content of generatePng getBuffer base64 encoded`, async () => {
 
   const runTask = await runTaskFnFactory(mockReporting, getMockLogger());
   const encryptedHeaders = await encryptHeaders({});
-  const { content } = await runTask(
+  await runTask(
     'pngJobId',
     getBasePayload({ relativeUrl: '/app/kibana#/something', headers: encryptedHeaders }),
-    cancellationToken
+    cancellationToken,
+    stream
   );
 
   expect(content).toEqual(testContent);
diff --git a/x-pack/plugins/reporting/server/export_types/png/execute_job/index.ts b/x-pack/plugins/reporting/server/export_types/png/execute_job/index.ts
index 1dffd0ed4dd5a6..1027e895b2cd02 100644
--- a/x-pack/plugins/reporting/server/export_types/png/execute_job/index.ts
+++ b/x-pack/plugins/reporting/server/export_types/png/execute_job/index.ts
@@ -7,7 +7,7 @@
 
 import apm from 'elastic-apm-node';
 import * as Rx from 'rxjs';
-import { catchError, finalize, map, mergeMap, takeUntil } from 'rxjs/operators';
+import { catchError, finalize, map, mergeMap, takeUntil, tap } from 'rxjs/operators';
 import { PNG_JOB_TYPE } from '../../../../common/constants';
 import { TaskRunResult } from '../../../lib/tasks';
 import { RunTaskFn, RunTaskFnFactory } from '../../../types';
@@ -26,7 +26,7 @@ export const runTaskFnFactory: RunTaskFnFactory<
   const config = reporting.getConfig();
   const encryptionKey = config.get('encryptionKey');
 
-  return async function runTask(jobId, job, cancellationToken) {
+  return async function runTask(jobId, job, cancellationToken, stream) {
     const apmTrans = apm.startTransaction('reporting execute_job png', 'reporting');
     const apmGetAssets = apmTrans?.startSpan('get_assets', 'setup');
     let apmGeneratePng: { end: () => void } | null | undefined;
@@ -51,9 +51,9 @@ export const runTaskFnFactory: RunTaskFnFactory<
           job.layout
         );
       }),
+      tap(({ base64 }) => stream.write(base64)),
       map(({ base64, warnings }) => ({
         content_type: 'image/png',
-        content: base64,
         size: (base64 && base64.length) || 0,
         warnings,
       })),
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.test.ts b/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.test.ts
index a9863a7edf6072..d58ec4cde0f3d8 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.test.ts
+++ b/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.test.ts
@@ -7,6 +7,7 @@
 
 jest.mock('../lib/generate_pdf', () => ({ generatePdfObservableFactory: jest.fn() }));
 
+import { Writable } from 'stream';
 import * as Rx from 'rxjs';
 import { ReportingCore } from '../../../';
 import { CancellationToken } from '../../../../common';
@@ -16,7 +17,9 @@ import { generatePdfObservableFactory } from '../lib/generate_pdf';
 import { TaskPayloadPDF } from '../types';
 import { runTaskFnFactory } from './';
 
+let content: string;
 let mockReporting: ReportingCore;
+let stream: jest.Mocked<Writable>;
 
 const cancellationToken = ({
   on: jest.fn(),
@@ -40,6 +43,9 @@ const encryptHeaders = async (headers: Record<string, string>) => {
 const getBasePayload = (baseObj: any) => baseObj as TaskPayloadPDF;
 
 beforeEach(async () => {
+  content = '';
+  stream = ({ write: jest.fn((chunk) => (content += chunk)) } as unknown) as typeof stream;
+
   const reportingConfig = {
     'server.basePath': '/sbp',
     index: '.reports-test',
@@ -71,7 +77,8 @@ test(`passes browserTimezone to generatePdf`, async () => {
       browserTimezone,
       headers: encryptedHeaders,
     }),
-    cancellationToken
+    cancellationToken,
+    stream
   );
 
   const tzParam = generatePdfObservable.mock.calls[0][3];
@@ -89,7 +96,8 @@ test(`returns content_type of application/pdf`, async () => {
   const { content_type: contentType } = await runTask(
     'pdfJobId',
     getBasePayload({ relativeUrls: [], headers: encryptedHeaders }),
-    cancellationToken
+    cancellationToken,
+    stream
   );
   expect(contentType).toBe('application/pdf');
 });
@@ -101,10 +109,11 @@ test(`returns content of generatePdf getBuffer base64 encoded`, async () => {
 
   const runTask = runTaskFnFactory(mockReporting, getMockLogger());
   const encryptedHeaders = await encryptHeaders({});
-  const { content } = await runTask(
+  await runTask(
     'pdfJobId',
     getBasePayload({ relativeUrls: [], headers: encryptedHeaders }),
-    cancellationToken
+    cancellationToken,
+    stream
   );
 
   expect(content).toEqual(Buffer.from(testContent).toString('base64'));
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.ts b/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.ts
index 8e215f87b52e0b..a878c51ba02e29 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.ts
+++ b/x-pack/plugins/reporting/server/export_types/printable_pdf/execute_job/index.ts
@@ -27,7 +27,7 @@ export const runTaskFnFactory: RunTaskFnFactory<
   const config = reporting.getConfig();
   const encryptionKey = config.get('encryptionKey');
 
-  return async function runTask(jobId, job, cancellationToken) {
+  return async function runTask(jobId, job, cancellationToken, stream) {
     const jobLogger = parentLogger.clone([PDF_JOB_TYPE, 'execute-job', jobId]);
     const apmTrans = apm.startTransaction('reporting execute_job pdf', 'reporting');
     const apmGetAssets = apmTrans?.startSpan('get_assets', 'setup');
@@ -46,7 +46,7 @@ export const runTaskFnFactory: RunTaskFnFactory<
         const urls = getFullUrls(config, job);
 
         const { browserTimezone, layout, title } = job;
-        if (apmGetAssets) apmGetAssets.end();
+        apmGetAssets?.end();
 
         apmGeneratePdf = apmTrans?.startSpan('generate_pdf_pipeline', 'execute');
         return generatePdfObservable(
@@ -60,15 +60,15 @@ export const runTaskFnFactory: RunTaskFnFactory<
         );
       }),
       map(({ buffer, warnings }) => {
-        if (apmGeneratePdf) apmGeneratePdf.end();
-
+        apmGeneratePdf?.end();
         const apmEncode = apmTrans?.startSpan('encode_pdf', 'output');
         const content = buffer?.toString('base64') || null;
-        if (apmEncode) apmEncode.end();
+        apmEncode?.end();
+
+        stream.write(content);
 
         return {
           content_type: 'application/pdf',
-          content,
           size: buffer?.byteLength || 0,
           warnings,
         };
@@ -81,7 +81,7 @@ export const runTaskFnFactory: RunTaskFnFactory<
 
     const stop$ = Rx.fromEventPattern(cancellationToken.on);
 
-    if (apmTrans) apmTrans.end();
+    apmTrans?.end();
     return process$.pipe(takeUntil(stop$)).toPromise();
   };
 };
diff --git a/x-pack/plugins/reporting/server/lib/content_stream.test.ts b/x-pack/plugins/reporting/server/lib/content_stream.test.ts
new file mode 100644
index 00000000000000..793fcc9c8a425a
--- /dev/null
+++ b/x-pack/plugins/reporting/server/lib/content_stream.test.ts
@@ -0,0 +1,124 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { set } from 'lodash';
+import { ElasticsearchClient } from 'src/core/server';
+import { elasticsearchServiceMock } from 'src/core/server/mocks';
+import { ContentStream } from './content_stream';
+
+describe('ContentStream', () => {
+  let client: jest.Mocked<ElasticsearchClient>;
+  let stream: ContentStream;
+
+  beforeEach(() => {
+    client = elasticsearchServiceMock.createClusterClient().asInternalUser;
+    stream = new ContentStream(client, { id: 'something', index: 'somewhere' });
+
+    client.search.mockResolvedValue(
+      set<any>({}, 'body.hits.hits.0._source.output.content', 'some content')
+    );
+  });
+
+  describe('read', () => {
+    it('should perform a search using index and the document id', async () => {
+      await new Promise((resolve) => stream.once('data', resolve));
+
+      expect(client.search).toHaveBeenCalledTimes(1);
+
+      const [[request]] = client.search.mock.calls;
+      expect(request).toHaveProperty('index', 'somewhere');
+      expect(request).toHaveProperty(
+        'body.query.constant_score.filter.bool.must.0.term._id',
+        'something'
+      );
+    });
+
+    it('should read the document contents', async () => {
+      const data = await new Promise((resolve) => stream.once('data', resolve));
+
+      expect(data).toEqual(Buffer.from('some content'));
+    });
+
+    it('should be an empty stream on empty response', async () => {
+      client.search.mockResolvedValueOnce({ body: {} } as any);
+      const onData = jest.fn();
+
+      stream.on('data', onData);
+      await new Promise((resolve) => stream.once('end', resolve));
+
+      expect(onData).not.toHaveBeenCalled();
+    });
+
+    it('should emit an error event', async () => {
+      client.search.mockRejectedValueOnce('some error');
+
+      stream.read();
+      const error = await new Promise((resolve) => stream.once('error', resolve));
+
+      expect(error).toBe('some error');
+    });
+  });
+
+  describe('toString', () => {
+    it('should return the document contents', async () => {
+      await expect(stream.toString()).resolves.toBe('some content');
+    });
+
+    it('should return an empty string for the empty document', async () => {
+      client.search.mockResolvedValueOnce({ body: {} } as any);
+
+      await expect(stream.toString()).resolves.toBe('');
+    });
+  });
+
+  describe('write', () => {
+    it('should not send a request until stream is closed', () => {
+      stream.write('something');
+
+      expect(client.update).not.toHaveBeenCalled();
+    });
+
+    it('should send the contents when stream ends', async () => {
+      stream.write('123');
+      stream.write('456');
+      stream.end();
+      await new Promise((resolve) => stream.once('finish', resolve));
+
+      expect(client.update).toHaveBeenCalledTimes(1);
+
+      const [[request]] = client.update.mock.calls;
+
+      expect(request).toHaveProperty('id', 'something');
+      expect(request).toHaveProperty('index', 'somewhere');
+      expect(request).toHaveProperty('body.doc.output.content', '123456');
+    });
+
+    it('should emit an error event', async () => {
+      client.update.mockRejectedValueOnce('some error');
+
+      stream.end('data');
+      const error = await new Promise((resolve) => stream.once('error', resolve));
+
+      expect(error).toBe('some error');
+    });
+
+    it('should update _seq_no and _primary_term from the response', async () => {
+      client.update.mockResolvedValueOnce({
+        body: {
+          _primary_term: 1,
+          _seq_no: 10,
+        },
+      } as any);
+
+      stream.end('something');
+      await new Promise((resolve) => stream.once('finish', resolve));
+
+      expect(stream.getPrimaryTerm()).toBe(1);
+      expect(stream.getSeqNo()).toBe(10);
+    });
+  });
+});
diff --git a/x-pack/plugins/reporting/server/lib/content_stream.ts b/x-pack/plugins/reporting/server/lib/content_stream.ts
new file mode 100644
index 00000000000000..5f95394abfb57f
--- /dev/null
+++ b/x-pack/plugins/reporting/server/lib/content_stream.ts
@@ -0,0 +1,112 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { Duplex } from 'stream';
+import type { ElasticsearchClient } from 'src/core/server';
+import { ReportingCore } from '..';
+import { ReportDocument } from '../../common/types';
+
+type Callback = (error?: Error) => void;
+type SearchRequest = Required<Parameters<ElasticsearchClient['search']>>[0];
+
+interface ContentStreamDocument {
+  id: string;
+  index: string;
+  if_primary_term?: number;
+  if_seq_no?: number;
+}
+
+export class ContentStream extends Duplex {
+  private buffer = '';
+  private primaryTerm?: number;
+  private seqNo?: number;
+
+  constructor(private client: ElasticsearchClient, private document: ContentStreamDocument) {
+    super();
+  }
+
+  async _read() {
+    const { id, index } = this.document;
+    const body: SearchRequest['body'] = {
+      _source: { includes: ['output.content'] },
+      query: {
+        constant_score: {
+          filter: {
+            bool: {
+              must: [{ term: { _id: id } }],
+            },
+          },
+        },
+      },
+      size: 1,
+    };
+
+    try {
+      const response = await this.client.search({ body, index });
+      const hits = response?.body.hits?.hits?.[0] as ReportDocument | undefined;
+      const output = hits?._source.output?.content;
+
+      if (output != null) {
+        this.push(output);
+      }
+
+      this.push(null);
+    } catch (error) {
+      this.destroy(error);
+    }
+  }
+
+  _write(chunk: Buffer | string, _encoding: string, callback: Callback) {
+    this.buffer += typeof chunk === 'string' ? chunk : chunk.toString();
+    callback();
+  }
+
+  async _final(callback: Callback) {
+    try {
+      const { body } = await this.client.update<ReportDocument>({
+        ...this.document,
+        body: {
+          doc: {
+            output: {
+              content: this.buffer,
+            },
+          },
+        },
+      });
+
+      ({ _primary_term: this.primaryTerm, _seq_no: this.seqNo } = body);
+      this.buffer = '';
+      callback();
+    } catch (error) {
+      callback(error);
+    }
+  }
+
+  async toString(): Promise<string> {
+    let result = '';
+
+    for await (const chunk of this) {
+      result += chunk;
+    }
+
+    return result;
+  }
+
+  getSeqNo(): number | undefined {
+    return this.seqNo;
+  }
+
+  getPrimaryTerm(): number | undefined {
+    return this.primaryTerm;
+  }
+}
+
+export async function getContentStream(reporting: ReportingCore, document: ContentStreamDocument) {
+  const { asInternalUser: client } = await reporting.getEsClient();
+
+  return new ContentStream(client, document);
+}
diff --git a/x-pack/plugins/reporting/server/lib/index.ts b/x-pack/plugins/reporting/server/lib/index.ts
index 37f57d97d3d4c6..cc61f5eb966162 100644
--- a/x-pack/plugins/reporting/server/lib/index.ts
+++ b/x-pack/plugins/reporting/server/lib/index.ts
@@ -7,6 +7,7 @@
 
 export { checkLicense } from './check_license';
 export { checkParamsVersion } from './check_params_version';
+export { ContentStream, getContentStream } from './content_stream';
 export { cryptoFactory } from './crypto';
 export { ExportTypesRegistry, getExportTypesRegistry } from './export_types_registry';
 export { LevelLogger } from './level_logger';
diff --git a/x-pack/plugins/reporting/server/lib/store/store.ts b/x-pack/plugins/reporting/server/lib/store/store.ts
index 40a73f294c5a97..da6460aa6a2a71 100644
--- a/x-pack/plugins/reporting/server/lib/store/store.ts
+++ b/x-pack/plugins/reporting/server/lib/store/store.ts
@@ -9,7 +9,7 @@ import { IndexResponse, UpdateResponse } from '@elastic/elasticsearch/api/types'
 import { ElasticsearchClient } from 'src/core/server';
 import { LevelLogger, statuses } from '../';
 import { ReportingCore } from '../../';
-import { JobStatus } from '../../../common/types';
+import { JobStatus, ReportOutput } from '../../../common/types';
 
 import { ILM_POLICY_NAME } from '../../../common/constants';
 
@@ -36,12 +36,12 @@ export type ReportProcessingFields = Required<{
 
 export type ReportFailedFields = Required<{
   completed_at: Report['completed_at'];
-  output: Report['output'];
+  output: ReportOutput | null;
 }>;
 
 export type ReportCompletedFields = Required<{
   completed_at: Report['completed_at'];
-  output: Report['output'];
+  output: Omit<ReportOutput, 'content'> | null;
 }>;
 
 /*
@@ -354,7 +354,7 @@ export class ReportingStore {
     const doc = sourceDoc({
       ...completedInfo,
       status,
-    });
+    } as ReportSource);
 
     try {
       checkReportIsEditable(report);
diff --git a/x-pack/plugins/reporting/server/lib/tasks/execute_report.ts b/x-pack/plugins/reporting/server/lib/tasks/execute_report.ts
index a52f452436d6db..1bbaa406088af0 100644
--- a/x-pack/plugins/reporting/server/lib/tasks/execute_report.ts
+++ b/x-pack/plugins/reporting/server/lib/tasks/execute_report.ts
@@ -5,11 +5,13 @@
  * 2.0.
  */
 
+import { Writable, finished } from 'stream';
+import { promisify } from 'util';
 import { UpdateResponse } from '@elastic/elasticsearch/api/types';
 import moment from 'moment';
 import * as Rx from 'rxjs';
 import { timeout } from 'rxjs/operators';
-import { LevelLogger } from '../';
+import { LevelLogger, getContentStream } from '../';
 import { ReportingCore } from '../../';
 import {
   RunContext,
@@ -17,6 +19,7 @@ import {
   TaskRunCreatorFunction,
 } from '../../../../task_manager/server';
 import { CancellationToken } from '../../../common';
+import { ReportOutput } from '../../../common/types';
 import { durationToNumber, numberToDuration } from '../../../common/schema_utils';
 import { ReportingConfigType } from '../../config';
 import { BasePayload, RunTaskFn } from '../../types';
@@ -38,8 +41,8 @@ interface ReportingExecuteTaskInstance {
   runAt?: Date;
 }
 
-function isOutput(output: TaskRunResult | Error): output is TaskRunResult {
-  return typeof output === 'object' && (output as TaskRunResult).content != null;
+function isOutput(output: any): output is TaskRunResult {
+  return output?.size != null;
 }
 
 function reportFromTask(task: ReportTaskParams) {
@@ -201,12 +204,11 @@ export class ExecuteReportTask implements ReportingTask {
     return await store.setReportFailed(report, doc);
   }
 
-  private _formatOutput(output: TaskRunResult | Error): TaskRunResult {
-    const docOutput = {} as TaskRunResult;
+  private _formatOutput(output: TaskRunResult | Error): ReportOutput {
+    const docOutput = {} as ReportOutput;
     const unknownMime = null;
 
     if (isOutput(output)) {
-      docOutput.content = output.content;
       docOutput.content_type = output.content_type || unknownMime;
       docOutput.max_size_reached = output.max_size_reached;
       docOutput.csv_contains_formulas = output.csv_contains_formulas;
@@ -225,7 +227,8 @@ export class ExecuteReportTask implements ReportingTask {
 
   public async _performJob(
     task: ReportTaskParams,
-    cancellationToken: CancellationToken
+    cancellationToken: CancellationToken,
+    stream: Writable
   ): Promise<TaskRunResult> {
     if (!this.taskExecutors) {
       throw new Error(`Task run function factories have not been called yet!`);
@@ -240,7 +243,7 @@ export class ExecuteReportTask implements ReportingTask {
     // run the report
     // if workerFn doesn't finish before timeout, call the cancellationToken and throw an error
     const queueTimeout = durationToNumber(this.config.queue.timeout);
-    return Rx.from(runner(task.id, task.payload, cancellationToken))
+    return Rx.from(runner(task.id, task.payload, cancellationToken, stream))
       .pipe(timeout(queueTimeout)) // throw an error if a value is not emitted before timeout
       .toPromise();
   }
@@ -252,7 +255,6 @@ export class ExecuteReportTask implements ReportingTask {
 
     const completedTime = moment().toISOString();
     const docOutput = this._formatOutput(output);
-
     const store = await this.getStore();
     const doc = {
       completed_at: completedTime,
@@ -320,7 +322,20 @@ export class ExecuteReportTask implements ReportingTask {
           this.logger.debug(`Reports running: ${this.reporting.countConcurrentReports()}.`);
 
           try {
-            const output = await this._performJob(task, cancellationToken);
+            const stream = await getContentStream(this.reporting, {
+              id: report._id,
+              index: report._index!,
+              if_primary_term: report._primary_term,
+              if_seq_no: report._seq_no,
+            });
+            const output = await this._performJob(task, cancellationToken, stream);
+
+            stream.end();
+            await promisify(finished)(stream, { readable: false });
+
+            report._seq_no = stream.getSeqNo();
+            report._primary_term = stream.getPrimaryTerm();
+
             if (output) {
               report = await this._completeJob(report, output);
             }
diff --git a/x-pack/plugins/reporting/server/routes/csv_searchsource_immediate.ts b/x-pack/plugins/reporting/server/routes/csv_searchsource_immediate.ts
index 8d31c03c618c9b..3d482d4f84d52f 100644
--- a/x-pack/plugins/reporting/server/routes/csv_searchsource_immediate.ts
+++ b/x-pack/plugins/reporting/server/routes/csv_searchsource_immediate.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { Writable } from 'stream';
 import { schema } from '@kbn/config-schema';
 import { KibanaRequest } from 'src/core/server';
 import { ReportingCore } from '../';
@@ -67,11 +68,23 @@ export function registerGenerateCsvFromSavedObjectImmediate(
       const runTaskFn = runTaskFnFactory(reporting, logger);
 
       try {
+        let buffer = Buffer.from('');
+        const stream = new Writable({
+          write(chunk, encoding, callback) {
+            buffer = Buffer.concat([
+              buffer,
+              Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, encoding),
+            ]);
+            callback();
+          },
+        });
+
         const {
           content_type: jobOutputContentType,
-          content: jobOutputContent,
           size: jobOutputSize,
-        }: TaskRunResult = await runTaskFn(null, req.body, context, req);
+        }: TaskRunResult = await runTaskFn(null, req.body, context, stream, req);
+        stream.end();
+        const jobOutputContent = buffer.toString();
 
         logger.info(`Job output size: ${jobOutputSize} bytes`);
 
diff --git a/x-pack/plugins/reporting/server/routes/jobs.test.ts b/x-pack/plugins/reporting/server/routes/jobs.test.ts
index 3040ea351f7d04..b666f0a2f394d0 100644
--- a/x-pack/plugins/reporting/server/routes/jobs.test.ts
+++ b/x-pack/plugins/reporting/server/routes/jobs.test.ts
@@ -5,6 +5,10 @@
  * 2.0.
  */
 
+jest.mock('../lib/content_stream', () => ({
+  getContentStream: jest.fn(),
+}));
+
 import { UnwrapPromise } from '@kbn/utility-types';
 import type { DeeplyMockedKeys } from '@kbn/utility-types/jest';
 import { of } from 'rxjs';
@@ -13,7 +17,7 @@ import { setupServer } from 'src/core/server/test_utils';
 import supertest from 'supertest';
 import { ReportingCore } from '..';
 import { ReportingInternalSetup } from '../core';
-import { ExportTypesRegistry } from '../lib/export_types_registry';
+import { ContentStream, ExportTypesRegistry, getContentStream } from '../lib';
 import {
   createMockConfigSchema,
   createMockPluginSetup,
@@ -32,6 +36,7 @@ describe('GET /api/reporting/jobs/download', () => {
   let core: ReportingCore;
   let mockSetupDeps: ReportingInternalSetup;
   let mockEsClient: DeeplyMockedKeys<ElasticsearchClient>;
+  let stream: jest.Mocked<ContentStream>;
 
   const getHits = (...sources: any) => {
     return {
@@ -93,6 +98,9 @@ describe('GET /api/reporting/jobs/download', () => {
     core.getExportTypesRegistry = () => exportTypesRegistry;
 
     mockEsClient = (await core.getEsClient()).asInternalUser as typeof mockEsClient;
+    stream = ({ toString: jest.fn(() => 'test') } as unknown) as typeof stream;
+
+    (getContentStream as jest.MockedFunction<typeof getContentStream>).mockResolvedValue(stream);
   });
 
   afterEach(async () => {
@@ -188,10 +196,10 @@ describe('GET /api/reporting/jobs/download', () => {
       body: getHits({
         jobtype: 'unencodedJobType',
         status: 'failed',
-        output: { content: 'job failure message' },
         payload: { title: 'failing job!' },
       }),
     } as any);
+    stream.toString.mockResolvedValueOnce('job failure message');
     registerJobInfoRoutes(core);
 
     await server.start();
@@ -207,14 +215,13 @@ describe('GET /api/reporting/jobs/download', () => {
   describe('successful downloads', () => {
     const getCompleteHits = ({
       jobType = 'unencodedJobType',
-      outputContent = 'job output content',
       outputContentType = 'text/plain',
       title = '',
     } = {}) => {
       return getHits({
         jobtype: jobType,
         status: 'completed',
-        output: { content: outputContent, content_type: outputContentType },
+        output: { content_type: outputContentType },
         payload: { title },
       });
     };
@@ -252,7 +259,6 @@ describe('GET /api/reporting/jobs/download', () => {
       mockEsClient.search.mockResolvedValueOnce({
         body: getCompleteHits({
           jobType: 'unencodedJobType',
-          outputContent: 'test',
         }),
       } as any);
       registerJobInfoRoutes(core);
@@ -269,7 +275,6 @@ describe('GET /api/reporting/jobs/download', () => {
       mockEsClient.search.mockResolvedValueOnce({
         body: getCompleteHits({
           jobType: 'base64EncodedJobType',
-          outputContent: 'test',
           outputContentType: 'application/pdf',
         }),
       } as any);
@@ -288,7 +293,6 @@ describe('GET /api/reporting/jobs/download', () => {
       mockEsClient.search.mockResolvedValueOnce({
         body: getCompleteHits({
           jobType: 'unencodedJobType',
-          outputContent: 'alert("all your base mine now");',
           outputContentType: 'application/html',
         }),
       } as any);
diff --git a/x-pack/plugins/reporting/server/routes/lib/get_document_payload.ts b/x-pack/plugins/reporting/server/routes/lib/get_document_payload.ts
index 2141252c70bfa0..869eb93bd3b429 100644
--- a/x-pack/plugins/reporting/server/routes/lib/get_document_payload.ts
+++ b/x-pack/plugins/reporting/server/routes/lib/get_document_payload.ts
@@ -8,10 +8,10 @@
 // @ts-ignore
 import contentDisposition from 'content-disposition';
 import { CSV_JOB_TYPE, CSV_JOB_TYPE_DEPRECATED } from '../../../common/constants';
-import { ExportTypesRegistry, statuses } from '../../lib';
-import { TaskRunResult } from '../../lib/tasks';
+import { ReportApiJSON } from '../../../common/types';
+import { ReportingCore } from '../../';
+import { getContentStream, statuses } from '../../lib';
 import { ExportTypeDefinition } from '../../types';
-import { ReportContent } from './jobs_query';
 
 export interface ErrorFromPayload {
   message: string;
@@ -25,6 +25,8 @@ interface Payload {
   headers: Record<string, any>;
 }
 
+type TaskRunResult = Required<ReportApiJSON>['output'];
+
 const DEFAULT_TITLE = 'report';
 
 const getTitle = (exportType: ExportTypeDefinition, title?: string): string =>
@@ -44,7 +46,9 @@ const getReportingHeaders = (output: TaskRunResult, exportType: ExportTypeDefini
   return metaDataHeaders;
 };
 
-export function getDocumentPayloadFactory(exportTypesRegistry: ExportTypesRegistry) {
+export function getDocumentPayloadFactory(reporting: ReportingCore) {
+  const exportTypesRegistry = reporting.getExportTypesRegistry();
+
   function encodeContent(
     content: string | null,
     exportType: ExportTypeDefinition
@@ -57,7 +61,12 @@ export function getDocumentPayloadFactory(exportTypesRegistry: ExportTypesRegist
     }
   }
 
-  function getCompleted(output: TaskRunResult, jobType: string, title: string): Payload {
+  async function getCompleted(
+    output: TaskRunResult,
+    jobType: string,
+    title: string,
+    content: string
+  ): Promise<Payload> {
     const exportType = exportTypesRegistry.get(
       (item: ExportTypeDefinition) => item.jobType === jobType
     );
@@ -66,7 +75,7 @@ export function getDocumentPayloadFactory(exportTypesRegistry: ExportTypesRegist
 
     return {
       statusCode: 200,
-      content: encodeContent(output.content, exportType),
+      content: encodeContent(content, exportType),
       contentType: output.content_type,
       headers: {
         ...headers,
@@ -77,11 +86,11 @@ export function getDocumentPayloadFactory(exportTypesRegistry: ExportTypesRegist
 
   // @TODO: These should be semantic HTTP codes as 500/503's indicate
   // error then these are really operating properly.
-  function getFailure(output: TaskRunResult): Payload {
+  function getFailure(content: string): Payload {
     return {
       statusCode: 500,
       content: {
-        message: `Reporting generation failed: ${output.content}`,
+        message: `Reporting generation failed: ${content}`,
       },
       contentType: 'application/json',
       headers: {},
@@ -97,19 +106,24 @@ export function getDocumentPayloadFactory(exportTypesRegistry: ExportTypesRegist
     };
   }
 
-  return function getDocumentPayload({
+  return async function getDocumentPayload({
+    id,
+    index,
+    output,
     status,
     jobtype: jobType,
-    payload: { title } = { title: 'unknown' },
-    output,
-  }: ReportContent): Payload {
+    payload: { title },
+  }: ReportApiJSON): Promise<Payload> {
     if (output) {
+      const stream = await getContentStream(reporting, { id, index });
+      const content = await stream.toString();
+
       if (status === statuses.JOB_STATUS_COMPLETED || status === statuses.JOB_STATUS_WARNINGS) {
-        return getCompleted(output, jobType, title);
+        return getCompleted(output, jobType, title, content);
       }
 
       if (status === statuses.JOB_STATUS_FAILED) {
-        return getFailure(output);
+        return getFailure(content);
       }
     }
 
diff --git a/x-pack/plugins/reporting/server/routes/lib/job_response_handler.ts b/x-pack/plugins/reporting/server/routes/lib/job_response_handler.ts
index f9519f74060f91..9f90be09bccbc5 100644
--- a/x-pack/plugins/reporting/server/routes/lib/job_response_handler.ts
+++ b/x-pack/plugins/reporting/server/routes/lib/job_response_handler.ts
@@ -22,8 +22,7 @@ interface JobResponseHandlerOpts {
 
 export function downloadJobResponseHandlerFactory(reporting: ReportingCore) {
   const jobsQuery = jobsQueryFactory(reporting);
-  const exportTypesRegistry = reporting.getExportTypesRegistry();
-  const getDocumentPayload = getDocumentPayloadFactory(exportTypesRegistry);
+  const getDocumentPayload = getDocumentPayloadFactory(reporting);
 
   return async function jobResponseHandler(
     res: typeof kibanaResponseFactory,
@@ -35,7 +34,7 @@ export function downloadJobResponseHandlerFactory(reporting: ReportingCore) {
     try {
       const { docId } = params;
 
-      const doc = await jobsQuery.getContent(user, docId);
+      const doc = await jobsQuery.get(user, docId);
       if (!doc) {
         return res.notFound();
       }
@@ -46,7 +45,7 @@ export function downloadJobResponseHandlerFactory(reporting: ReportingCore) {
         });
       }
 
-      const payload = getDocumentPayload(doc);
+      const payload = await getDocumentPayload(doc);
 
       if (!payload.contentType || !ALLOWED_JOB_CONTENT_TYPES.includes(payload.contentType)) {
         return res.badRequest({
diff --git a/x-pack/plugins/reporting/server/routes/lib/jobs_query.ts b/x-pack/plugins/reporting/server/routes/lib/jobs_query.ts
index a0d6962074a708..3e33124b1ed0f0 100644
--- a/x-pack/plugins/reporting/server/routes/lib/jobs_query.ts
+++ b/x-pack/plugins/reporting/server/routes/lib/jobs_query.ts
@@ -12,8 +12,7 @@ import { i18n } from '@kbn/i18n';
 import { UnwrapPromise } from '@kbn/utility-types';
 import { ElasticsearchClient } from 'src/core/server';
 import { ReportingCore } from '../../';
-import { JobContent, ReportApiJSON, ReportDocument, ReportSource } from '../../../common/types';
-import { statuses } from '../../lib/statuses';
+import { ReportApiJSON, ReportSource } from '../../../common/types';
 import { Report } from '../../lib/store';
 import { ReportingUser } from '../../types';
 
@@ -47,8 +46,6 @@ interface JobsQueryFactory {
   ): Promise<ReportApiJSON[]>;
   count(jobTypes: string[], user: ReportingUser): Promise<number>;
   get(user: ReportingUser, id: string): Promise<ReportApiJSON | void>;
-  getContent(user: ReportingUser, id: string): Promise<ReportContent | void>;
-  getError(user: ReportingUser, id: string): Promise<(ReportContent & JobContent) | void>;
   delete(deleteIndex: string, id: string): Promise<ApiResponse<DeleteResponse>>;
 }
 
@@ -169,58 +166,6 @@ export function jobsQueryFactory(reportingCore: ReportingCore): JobsQueryFactory
       return report.toApiJSON();
     },
 
-    async getContent(user, id) {
-      if (!id) {
-        return;
-      }
-
-      const username = getUsername(user);
-      const body: SearchRequest['body'] = {
-        _source: { excludes: ['payload.headers'] },
-        query: {
-          constant_score: {
-            filter: {
-              bool: {
-                must: [{ term: { _id: id } }, { term: { created_by: username } }],
-              },
-            },
-          },
-        },
-        size: 1,
-      };
-
-      const response = await execQuery((elasticsearchClient) =>
-        elasticsearchClient.search({ body, index: getIndex() })
-      );
-
-      if (response?.body.hits?.hits?.length !== 1) {
-        return;
-      }
-
-      const report = response.body.hits.hits[0] as ReportDocument;
-
-      return {
-        status: report._source.status,
-        jobtype: report._source.jobtype,
-        output: report._source.output,
-        payload: report._source.payload,
-      };
-    },
-
-    async getError(user, id) {
-      const content = await this.getContent(user, id);
-      if (content && content?.output?.content) {
-        if (content.status !== statuses.JOB_STATUS_FAILED) {
-          throw new Error(`Can not get error for ${id}`);
-        }
-        return {
-          ...content,
-          content: content.output.content,
-          content_type: false,
-        };
-      }
-    },
-
     async delete(deleteIndex, id) {
       try {
         const { asInternalUser: elasticsearchClient } = await reportingCore.getEsClient();
diff --git a/x-pack/plugins/reporting/server/test_helpers/create_mock_reportingplugin.ts b/x-pack/plugins/reporting/server/test_helpers/create_mock_reportingplugin.ts
index 695f29dd8d6324..8ad2e62d98c522 100644
--- a/x-pack/plugins/reporting/server/test_helpers/create_mock_reportingplugin.ts
+++ b/x-pack/plugins/reporting/server/test_helpers/create_mock_reportingplugin.ts
@@ -12,7 +12,7 @@ jest.mock('../browsers');
 import _ from 'lodash';
 import * as Rx from 'rxjs';
 import { coreMock, elasticsearchServiceMock } from 'src/core/server/mocks';
-import { fieldFormats } from 'src/plugins/data/server';
+import { FieldFormatsRegistry } from 'src/plugins/field_formats/common';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { dataPluginMock } from 'src/plugins/data/server/mocks';
 import { ReportingConfig, ReportingCore } from '../';
@@ -171,7 +171,7 @@ export const createMockReportingCore = async (
 
   setFieldFormats({
     fieldFormatServiceFactory() {
-      const fieldFormatsRegistry = new fieldFormats.FieldFormatsRegistry();
+      const fieldFormatsRegistry = new FieldFormatsRegistry();
       return Promise.resolve(fieldFormatsRegistry);
     },
   });
diff --git a/x-pack/plugins/reporting/server/types.ts b/x-pack/plugins/reporting/server/types.ts
index da228b09f79d26..16cd247b4d00e4 100644
--- a/x-pack/plugins/reporting/server/types.ts
+++ b/x-pack/plugins/reporting/server/types.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { Writable } from 'stream';
 import type { IRouter, KibanaRequest, RequestHandlerContext } from 'src/core/server';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { DataPluginStart } from 'src/plugins/data/server/plugin';
@@ -76,7 +77,8 @@ export type CreateJobFn<JobParamsType = BaseParams, JobPayloadType = BasePayload
 export type RunTaskFn<TaskPayloadType = BasePayload> = (
   jobId: string,
   payload: ReportTaskParams<TaskPayloadType>['payload'],
-  cancellationToken: CancellationToken
+  cancellationToken: CancellationToken,
+  stream: Writable
 ) => Promise<TaskRunResult>;
 
 export type CreateJobFnFactory<CreateJobFnType> = (
diff --git a/x-pack/plugins/reporting/tsconfig.json b/x-pack/plugins/reporting/tsconfig.json
index c28086b96aea28..406fe9965b8a03 100644
--- a/x-pack/plugins/reporting/tsconfig.json
+++ b/x-pack/plugins/reporting/tsconfig.json
@@ -24,6 +24,7 @@
     { "path": "../../../src/plugins/share/tsconfig.json" },
     { "path": "../../../src/plugins/ui_actions/tsconfig.json" },
     { "path": "../../../src/plugins/usage_collection/tsconfig.json" },
+    { "path": "../../../src/plugins/field_formats/tsconfig.json" },
     { "path": "../features/tsconfig.json" },
     { "path": "../licensing/tsconfig.json" },
     { "path": "../security/tsconfig.json" },
diff --git a/x-pack/plugins/rule_registry/README.md b/x-pack/plugins/rule_registry/README.md
index 19e276aeec4895..16e4b8f3e01e65 100644
--- a/x-pack/plugins/rule_registry/README.md
+++ b/x-pack/plugins/rule_registry/README.md
@@ -124,7 +124,6 @@ The following fields are defined in the technical field component template and s
 - `rule.uuid`: the saved objects id of the rule.
 - `rule.name`: the name of the rule (as specified by the user).
 - `rule.category`: the name of the rule type (as defined by the rule type producer)
-- `kibana.alert.producer`: the producer of the rule type. Usually a Kibana plugin. e.g., `APM`.
 - `kibana.alert.owner`: the feature which produced the alert. Usually a Kibana feature id like `apm`, `siem`...
 - `kibana.alert.id`: the id of the alert, that is unique within the context of the rule execution it was created in. E.g., for a rule that monitors latency for all services in all environments, this might be `opbeans-java:production`.
 - `kibana.alert.uuid`: the unique identifier for the alert during its lifespan. If an alert recovers (or closes), this identifier is re-generated when it is opened again.
diff --git a/x-pack/plugins/rule_registry/common/assets/field_maps/ecs_field_map.ts b/x-pack/plugins/rule_registry/common/assets/field_maps/ecs_field_map.ts
index ff81e05851f7e5..859070bd498e32 100644
--- a/x-pack/plugins/rule_registry/common/assets/field_maps/ecs_field_map.ts
+++ b/x-pack/plugins/rule_registry/common/assets/field_maps/ecs_field_map.ts
@@ -2148,7 +2148,7 @@ export const ecsFieldMap = {
   'rule.id': {
     type: 'keyword',
     array: false,
-    required: false,
+    required: true,
   },
   'rule.license': {
     type: 'keyword',
diff --git a/x-pack/plugins/rule_registry/common/assets/field_maps/technical_rule_field_map.ts b/x-pack/plugins/rule_registry/common/assets/field_maps/technical_rule_field_map.ts
index ebe7c88f756b20..11e572260d1335 100644
--- a/x-pack/plugins/rule_registry/common/assets/field_maps/technical_rule_field_map.ts
+++ b/x-pack/plugins/rule_registry/common/assets/field_maps/technical_rule_field_map.ts
@@ -20,9 +20,9 @@ export const technicalRuleFieldMap = {
     Fields.RULE_CATEGORY,
     Fields.TAGS
   ),
-  [Fields.ALERT_OWNER]: { type: 'keyword' },
+  [Fields.ALERT_OWNER]: { type: 'keyword', required: true },
   [Fields.ALERT_PRODUCER]: { type: 'keyword' },
-  [Fields.SPACE_IDS]: { type: 'keyword', array: true },
+  [Fields.SPACE_IDS]: { type: 'keyword', array: true, required: true },
   [Fields.ALERT_UUID]: { type: 'keyword' },
   [Fields.ALERT_ID]: { type: 'keyword' },
   [Fields.ALERT_START]: { type: 'date' },
diff --git a/x-pack/plugins/rule_registry/server/index.ts b/x-pack/plugins/rule_registry/server/index.ts
index af086abadbb728..cbd8145a44fe78 100644
--- a/x-pack/plugins/rule_registry/server/index.ts
+++ b/x-pack/plugins/rule_registry/server/index.ts
@@ -11,11 +11,11 @@ import { RuleRegistryPlugin } from './plugin';
 export * from './config';
 export type { RuleRegistryPluginSetupContract, RuleRegistryPluginStartContract } from './plugin';
 export type { RacRequestHandlerContext, RacApiRequestHandlerContext } from './types';
+export { RuleDataPluginService } from './rule_data_plugin_service';
 export { RuleDataClient } from './rule_data_client';
 export { IRuleDataClient } from './rule_data_client/types';
 export { getRuleData, RuleExecutorData } from './utils/get_rule_executor_data';
 export { createLifecycleRuleTypeFactory } from './utils/create_lifecycle_rule_type_factory';
-export { RuleDataPluginService } from './rule_data_plugin_service';
 export {
   LifecycleRuleExecutor,
   LifecycleAlertService,
diff --git a/x-pack/plugins/rule_registry/server/mocks.ts b/x-pack/plugins/rule_registry/server/mocks.ts
index cc5c3cfd484a7c..395b53e229d643 100644
--- a/x-pack/plugins/rule_registry/server/mocks.ts
+++ b/x-pack/plugins/rule_registry/server/mocks.ts
@@ -5,8 +5,10 @@
  * 2.0.
  */
 
+import { ruleDataPluginServiceMock } from './rule_data_plugin_service/rule_data_plugin_service.mock';
 import { createLifecycleAlertServicesMock } from './utils/lifecycle_alert_services_mock';
 
 export const ruleRegistryMocks = {
   createLifecycleAlertServices: createLifecycleAlertServicesMock,
+  createRuleDataPluginService: ruleDataPluginServiceMock.create,
 };
diff --git a/x-pack/plugins/rule_registry/server/routes/get_alert_by_id.test.ts b/x-pack/plugins/rule_registry/server/routes/get_alert_by_id.test.ts
index d89eb305545e88..073a48248f89ad 100644
--- a/x-pack/plugins/rule_registry/server/routes/get_alert_by_id.test.ts
+++ b/x-pack/plugins/rule_registry/server/routes/get_alert_by_id.test.ts
@@ -13,6 +13,7 @@ import {
   CONSUMERS,
   ECS_VERSION,
   RULE_ID,
+  SPACE_IDS,
   TIMESTAMP,
   VERSION,
 } from '@kbn/rule-data-utils';
@@ -33,6 +34,7 @@ const getMockAlert = (): ParsedTechnicalFields => ({
   [ALERT_OWNER]: 'apm',
   [ALERT_STATUS]: 'open',
   [ALERT_RULE_RISK_SCORE]: 20,
+  [SPACE_IDS]: ['fake-space-id'],
   [ALERT_RULE_SEVERITY]: 'warning',
 });
 
diff --git a/x-pack/plugins/rule_registry/server/rule_data_client/index.ts b/x-pack/plugins/rule_registry/server/rule_data_client/index.ts
index a9e559a6b19325..94427eee2e2e5d 100644
--- a/x-pack/plugins/rule_registry/server/rule_data_client/index.ts
+++ b/x-pack/plugins/rule_registry/server/rule_data_client/index.ts
@@ -96,10 +96,20 @@ export class RuleDataClient implements IRuleDataClient {
           if (response.body.errors) {
             if (
               response.body.items.length > 0 &&
-              response.body.items?.[0]?.index?.error?.type === 'index_not_found_exception'
+              (response.body.items.every(
+                (item) => item.index?.error?.type === 'index_not_found_exception'
+              ) ||
+                response.body.items.every(
+                  (item) => item.index?.error?.type === 'illegal_argument_exception'
+                ))
             ) {
               return this.createWriteTargetIfNeeded({ namespace }).then(() => {
-                return clusterClient.bulk(requestWithDefaultParameters);
+                return clusterClient.bulk(requestWithDefaultParameters).then((retryResponse) => {
+                  if (retryResponse.body.errors) {
+                    throw new ResponseError(retryResponse);
+                  }
+                  return retryResponse;
+                });
               });
             }
             const error = new ResponseError(response);
@@ -116,13 +126,14 @@ export class RuleDataClient implements IRuleDataClient {
 
     const clusterClient = await this.getClusterClient();
 
-    const { body: aliasExists } = await clusterClient.indices.existsAlias({
-      name: alias,
+    const { body: indicesExist } = await clusterClient.indices.exists({
+      index: `${alias}-*`,
+      allow_no_indices: false,
     });
 
     const concreteIndexName = `${alias}-000001`;
 
-    if (!aliasExists) {
+    if (!indicesExist) {
       try {
         await clusterClient.indices.create({
           index: concreteIndexName,
@@ -135,11 +146,37 @@ export class RuleDataClient implements IRuleDataClient {
           },
         });
       } catch (err) {
-        // something might have created the index already, that sounds OK
-        if (err?.meta?.body?.error?.type !== 'resource_already_exists_exception') {
+        // If the index already exists and it's the write index for the alias,
+        // something else created it so suppress the error. If it's not the write
+        // index, that's bad, throw an error.
+        if (err?.meta?.body?.error?.type === 'resource_already_exists_exception') {
+          const { body: existingIndices } = await clusterClient.indices.get({
+            index: concreteIndexName,
+          });
+          if (!existingIndices[concreteIndexName]?.aliases?.[alias]?.is_write_index) {
+            throw Error(
+              `Attempted to create index: ${concreteIndexName} as the write index for alias: ${alias}, but the index already exists and is not the write index for the alias`
+            );
+          }
+        } else {
           throw err;
         }
       }
+    } else {
+      // If we find indices matching the pattern, then we expect one of them to be the write index for the alias.
+      // Throw an error if none of them are the write index.
+      const { body: aliasesResponse } = await clusterClient.indices.getAlias({
+        index: `${alias}-*`,
+      });
+      if (
+        !Object.entries(aliasesResponse).some(
+          ([_, aliasesObject]) => aliasesObject.aliases[alias]?.is_write_index
+        )
+      ) {
+        throw Error(
+          `Indices matching pattern ${alias}-* exist but none are set as the write index for alias ${alias}`
+        );
+      }
     }
   }
 }
diff --git a/x-pack/plugins/rule_registry/server/rule_data_plugin_service/rule_data_plugin_service.mock.ts b/x-pack/plugins/rule_registry/server/rule_data_plugin_service/rule_data_plugin_service.mock.ts
index 275d68621864fc..348c0fc6b1cfce 100644
--- a/x-pack/plugins/rule_registry/server/rule_data_plugin_service/rule_data_plugin_service.mock.ts
+++ b/x-pack/plugins/rule_registry/server/rule_data_plugin_service/rule_data_plugin_service.mock.ts
@@ -6,11 +6,11 @@
  */
 
 import type { PublicMethodsOf } from '@kbn/utility-types';
-import { RuleDataPluginService, RuleDataPluginServiceConstructorOptions } from './';
+import { RuleDataPluginService } from './';
 
 type Schema = PublicMethodsOf<RuleDataPluginService>;
 
-const createRuleDataPluginServiceMock = (_: RuleDataPluginServiceConstructorOptions) => {
+const createRuleDataPluginService = () => {
   const mocked: jest.Mocked<Schema> = {
     init: jest.fn(),
     isReady: jest.fn(),
@@ -27,9 +27,7 @@ const createRuleDataPluginServiceMock = (_: RuleDataPluginServiceConstructorOpti
 };
 
 export const ruleDataPluginServiceMock: {
-  create: (
-    _: RuleDataPluginServiceConstructorOptions
-  ) => jest.Mocked<PublicMethodsOf<RuleDataPluginService>>;
+  create: () => jest.Mocked<PublicMethodsOf<RuleDataPluginService>>;
 } = {
-  create: createRuleDataPluginServiceMock,
+  create: createRuleDataPluginService,
 };
diff --git a/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.test.ts b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.test.ts
index 80b75b8c74732d..037efadabd8def 100644
--- a/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.test.ts
+++ b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.test.ts
@@ -23,6 +23,9 @@ import {
   ALERT_STATUS,
   EVENT_ACTION,
   EVENT_KIND,
+  RULE_ID,
+  ALERT_OWNER,
+  SPACE_IDS,
 } from '../../common/technical_rule_data_field_names';
 import { createRuleDataClientMock } from '../rule_data_client/create_rule_data_client_mock';
 import { createLifecycleExecutor } from './create_lifecycle_executor';
@@ -128,12 +131,16 @@ describe('createLifecycleExecutor', () => {
           {
             fields: {
               [ALERT_ID]: 'TEST_ALERT_0',
+              [ALERT_OWNER]: 'CONSUMER',
+              [RULE_ID]: 'RULE_TYPE_ID',
               labels: { LABEL_0_KEY: 'LABEL_0_VALUE' }, // this must not show up in the written doc
             },
           },
           {
             fields: {
               [ALERT_ID]: 'TEST_ALERT_1',
+              [ALERT_OWNER]: 'CONSUMER',
+              [RULE_ID]: 'RULE_TYPE_ID',
               labels: { LABEL_0_KEY: 'LABEL_0_VALUE' }, // this must not show up in the written doc
             },
           },
@@ -222,6 +229,9 @@ describe('createLifecycleExecutor', () => {
             fields: {
               '@timestamp': '',
               [ALERT_ID]: 'TEST_ALERT_0',
+              [ALERT_OWNER]: 'CONSUMER',
+              [RULE_ID]: 'RULE_TYPE_ID',
+              [SPACE_IDS]: ['fake-space-id'],
               labels: { LABEL_0_KEY: 'LABEL_0_VALUE' }, // this must show up in the written doc
             },
           },
@@ -229,6 +239,9 @@ describe('createLifecycleExecutor', () => {
             fields: {
               '@timestamp': '',
               [ALERT_ID]: 'TEST_ALERT_1',
+              [ALERT_OWNER]: 'CONSUMER',
+              [RULE_ID]: 'RULE_TYPE_ID',
+              [SPACE_IDS]: ['fake-space-id'],
               labels: { LABEL_0_KEY: 'LABEL_0_VALUE' }, // this must not show up in the written doc
             },
           },
diff --git a/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.ts b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.ts
index 50ac8afb945b43..23ae24cb91bc40 100644
--- a/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.ts
+++ b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.ts
@@ -30,6 +30,7 @@ import {
   EVENT_ACTION,
   EVENT_KIND,
   ALERT_OWNER,
+  RULE_ID,
   RULE_UUID,
   TIMESTAMP,
   SPACE_IDS,
@@ -154,6 +155,8 @@ export const createLifecycleExecutor = (
       currentAlerts[id] = {
         ...fields,
         [ALERT_ID]: id,
+        [RULE_ID]: rule.ruleTypeId,
+        [ALERT_OWNER]: rule.consumer,
       };
       return alertInstanceFactory(id);
     },
@@ -226,6 +229,8 @@ export const createLifecycleExecutor = (
       alertsDataMap[alertId] = {
         ...fields,
         [ALERT_ID]: alertId,
+        [RULE_ID]: rule.ruleTypeId,
+        [ALERT_OWNER]: rule.consumer,
       };
     });
   }
diff --git a/x-pack/plugins/security/public/management/roles/roles_grid/__snapshots__/roles_grid_page.test.tsx.snap b/x-pack/plugins/security/public/management/roles/roles_grid/__snapshots__/roles_grid_page.test.tsx.snap
index 74127617bfd458..6e99fdfd7743c4 100644
--- a/x-pack/plugins/security/public/management/roles/roles_grid/__snapshots__/roles_grid_page.test.tsx.snap
+++ b/x-pack/plugins/security/public/management/roles/roles_grid/__snapshots__/roles_grid_page.test.tsx.snap
@@ -81,6 +81,7 @@ exports[`<RolesGridPage /> renders permission denied if required 1`] = `
             >
               <span
                 className="euiTextColor euiTextColor--subdued"
+                style={Object {}}
               >
                 <EuiSpacer
                   size="m"
diff --git a/x-pack/plugins/security_solution/common/endpoint/models/policy_config.ts b/x-pack/plugins/security_solution/common/endpoint/models/policy_config.ts
index 4132f1d1a67bb4..2c742ad3fd6af8 100644
--- a/x-pack/plugins/security_solution/common/endpoint/models/policy_config.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/models/policy_config.ts
@@ -71,11 +71,19 @@ export const policyFactory = (): PolicyConfig => {
       malware: {
         mode: ProtectionModes.prevent,
       },
+      behavior_protection: {
+        mode: ProtectionModes.prevent,
+        supported: true,
+      },
       popup: {
         malware: {
           message: '',
           enabled: true,
         },
+        behavior_protection: {
+          message: '',
+          enabled: true,
+        },
       },
       logging: {
         file: 'info',
@@ -90,11 +98,19 @@ export const policyFactory = (): PolicyConfig => {
       malware: {
         mode: ProtectionModes.prevent,
       },
+      behavior_protection: {
+        mode: ProtectionModes.prevent,
+        supported: true,
+      },
       popup: {
         malware: {
           message: '',
           enabled: true,
         },
+        behavior_protection: {
+          message: '',
+          enabled: true,
+        },
       },
       logging: {
         file: 'info',
@@ -147,22 +163,38 @@ export const policyFactoryWithoutPaidFeatures = (
     },
     mac: {
       ...policy.mac,
+      behavior_protection: {
+        mode: ProtectionModes.off,
+        supported: false,
+      },
       popup: {
         ...policy.mac.popup,
         malware: {
           message: '',
           enabled: true,
         },
+        behavior_protection: {
+          message: '',
+          enabled: false,
+        },
       },
     },
     linux: {
       ...policy.linux,
+      behavior_protection: {
+        mode: ProtectionModes.off,
+        supported: false,
+      },
       popup: {
         ...policy.linux.popup,
         malware: {
           message: '',
           enabled: true,
         },
+        behavior_protection: {
+          message: '',
+          enabled: false,
+        },
       },
     },
   };
@@ -191,6 +223,20 @@ export const policyFactoryWithSupportedFeatures = (
         supported: true,
       },
     },
+    mac: {
+      ...policy.mac,
+      behavior_protection: {
+        ...policy.windows.behavior_protection,
+        supported: true,
+      },
+    },
+    linux: {
+      ...policy.linux,
+      behavior_protection: {
+        ...policy.windows.behavior_protection,
+        supported: true,
+      },
+    },
   };
 };
 
diff --git a/x-pack/plugins/security_solution/common/endpoint/types/index.ts b/x-pack/plugins/security_solution/common/endpoint/types/index.ts
index c771416c00df9e..d5a8caac1dffee 100644
--- a/x-pack/plugins/security_solution/common/endpoint/types/index.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/types/index.ts
@@ -900,11 +900,16 @@ export interface PolicyConfig {
       network: boolean;
     };
     malware: ProtectionFields;
+    behavior_protection: ProtectionFields & SupportedFields;
     popup: {
       malware: {
         message: string;
         enabled: boolean;
       };
+      behavior_protection: {
+        message: string;
+        enabled: boolean;
+      };
     };
     logging: {
       file: string;
@@ -918,11 +923,16 @@ export interface PolicyConfig {
       network: boolean;
     };
     malware: ProtectionFields;
+    behavior_protection: ProtectionFields & SupportedFields;
     popup: {
       malware: {
         message: string;
         enabled: boolean;
       };
+      behavior_protection: {
+        message: string;
+        enabled: boolean;
+      };
     };
     logging: {
       file: string;
@@ -951,11 +961,17 @@ export interface UIPolicyConfig {
   /**
    * Mac-specific policy configuration that is supported via the UI
    */
-  mac: Pick<PolicyConfig['mac'], 'malware' | 'events' | 'popup' | 'advanced'>;
+  mac: Pick<
+    PolicyConfig['mac'],
+    'malware' | 'events' | 'popup' | 'advanced' | 'behavior_protection'
+  >;
   /**
    * Linux-specific policy configuration that is supported via the UI
    */
-  linux: Pick<PolicyConfig['linux'], 'malware' | 'events' | 'popup' | 'advanced'>;
+  linux: Pick<
+    PolicyConfig['linux'],
+    'malware' | 'events' | 'popup' | 'advanced' | 'behavior_protection'
+  >;
 }
 
 /** Policy:  Protection fields */
diff --git a/x-pack/plugins/security_solution/common/experimental_features.ts b/x-pack/plugins/security_solution/common/experimental_features.ts
index 6d4a2b78840ea6..0ae42d4baaec45 100644
--- a/x-pack/plugins/security_solution/common/experimental_features.ts
+++ b/x-pack/plugins/security_solution/common/experimental_features.ts
@@ -16,6 +16,7 @@ export const allowedExperimentalValues = Object.freeze({
   ruleRegistryEnabled: false,
   tGridEnabled: false,
   trustedAppsByPolicyEnabled: false,
+  excludePoliciesInFilterEnabled: false,
   uebaEnabled: false,
 });
 
diff --git a/x-pack/plugins/security_solution/common/license/policy_config.test.ts b/x-pack/plugins/security_solution/common/license/policy_config.test.ts
index b6530be2fdc1be..98e19b36dd910f 100644
--- a/x-pack/plugins/security_solution/common/license/policy_config.test.ts
+++ b/x-pack/plugins/security_solution/common/license/policy_config.test.ts
@@ -86,6 +86,10 @@ describe('policy_config and licenses', () => {
       // behavior protection
       policy.windows.behavior_protection.mode = ProtectionModes.prevent;
       policy.windows.behavior_protection.supported = true;
+      policy.mac.behavior_protection.mode = ProtectionModes.prevent;
+      policy.mac.behavior_protection.supported = true;
+      policy.linux.behavior_protection.mode = ProtectionModes.prevent;
+      policy.linux.behavior_protection.supported = true;
 
       const valid = isEndpointPolicyValidForLicense(policy, Platinum);
       expect(valid).toBeTruthy();
@@ -102,6 +106,10 @@ describe('policy_config and licenses', () => {
       // behavior protection
       policy.windows.popup.behavior_protection.enabled = true;
       policy.windows.behavior_protection.supported = true;
+      policy.mac.popup.behavior_protection.enabled = true;
+      policy.mac.behavior_protection.supported = true;
+      policy.linux.popup.behavior_protection.enabled = true;
+      policy.linux.behavior_protection.supported = true;
       const valid = isEndpointPolicyValidForLicense(policy, Platinum);
       expect(valid).toBeTruthy();
     });
@@ -187,6 +195,8 @@ describe('policy_config and licenses', () => {
       it('blocks behavior_protection to be turned on for Gold and below licenses', () => {
         const policy = policyFactoryWithoutPaidFeatures();
         policy.windows.behavior_protection.mode = ProtectionModes.prevent;
+        policy.mac.behavior_protection.mode = ProtectionModes.prevent;
+        policy.linux.behavior_protection.mode = ProtectionModes.prevent;
 
         let valid = isEndpointPolicyValidForLicense(policy, Gold);
         expect(valid).toBeFalsy();
@@ -197,6 +207,8 @@ describe('policy_config and licenses', () => {
       it('blocks behavior_protection notification to be turned on for Gold and below licenses', () => {
         const policy = policyFactoryWithoutPaidFeatures();
         policy.windows.popup.behavior_protection.enabled = true;
+        policy.mac.popup.behavior_protection.enabled = true;
+        policy.linux.popup.behavior_protection.enabled = true;
         let valid = isEndpointPolicyValidForLicense(policy, Gold);
         expect(valid).toBeFalsy();
 
@@ -207,6 +219,8 @@ describe('policy_config and licenses', () => {
       it('allows behavior_protection notification message changes with a Platinum license', () => {
         const policy = policyFactory();
         policy.windows.popup.behavior_protection.message = 'BOOM';
+        policy.mac.popup.behavior_protection.message = 'BOOM';
+        policy.linux.popup.behavior_protection.message = 'BOOM';
         const valid = isEndpointPolicyValidForLicense(policy, Platinum);
         expect(valid).toBeTruthy();
       });
@@ -214,6 +228,8 @@ describe('policy_config and licenses', () => {
       it('blocks behavior_protection notification message changes for Gold and below licenses', () => {
         const policy = policyFactory();
         policy.windows.popup.behavior_protection.message = 'BOOM';
+        policy.mac.popup.behavior_protection.message = 'BOOM';
+        policy.linux.popup.behavior_protection.message = 'BOOM';
         let valid = isEndpointPolicyValidForLicense(policy, Gold);
         expect(valid).toBeFalsy();
 
@@ -275,11 +291,23 @@ describe('policy_config and licenses', () => {
       policy.windows.behavior_protection.mode = ProtectionModes.detect;
       policy.windows.popup.behavior_protection.enabled = false;
       policy.windows.popup.behavior_protection.message = popupMessage;
+      policy.mac.behavior_protection.mode = ProtectionModes.detect;
+      policy.mac.popup.behavior_protection.enabled = false;
+      policy.mac.popup.behavior_protection.message = popupMessage;
+      policy.linux.behavior_protection.mode = ProtectionModes.detect;
+      policy.linux.popup.behavior_protection.enabled = false;
+      policy.linux.popup.behavior_protection.message = popupMessage;
 
       const retPolicy = unsetPolicyFeaturesAccordingToLicenseLevel(policy, Platinum);
       expect(retPolicy.windows.behavior_protection.mode).toEqual(ProtectionModes.detect);
       expect(retPolicy.windows.popup.behavior_protection.enabled).toBeFalsy();
       expect(retPolicy.windows.popup.behavior_protection.message).toEqual(popupMessage);
+      expect(retPolicy.mac.behavior_protection.mode).toEqual(ProtectionModes.detect);
+      expect(retPolicy.mac.popup.behavior_protection.enabled).toBeFalsy();
+      expect(retPolicy.mac.popup.behavior_protection.message).toEqual(popupMessage);
+      expect(retPolicy.linux.behavior_protection.mode).toEqual(ProtectionModes.detect);
+      expect(retPolicy.linux.popup.behavior_protection.enabled).toBeFalsy();
+      expect(retPolicy.linux.popup.behavior_protection.message).toEqual(popupMessage);
     });
 
     it('resets Platinum-paid fields for lower license tiers', () => {
@@ -349,6 +377,8 @@ describe('policy_config and licenses', () => {
       const policy = policyFactory(); // what we will modify, and should be reset
       const popupMessage = 'WOOP WOOP';
       policy.windows.popup.behavior_protection.message = popupMessage;
+      policy.mac.popup.behavior_protection.message = popupMessage;
+      policy.linux.popup.behavior_protection.message = popupMessage;
 
       const retPolicy = unsetPolicyFeaturesAccordingToLicenseLevel(policy, Gold);
 
@@ -364,6 +394,30 @@ describe('policy_config and licenses', () => {
       expect(['', DefaultPolicyNotificationMessage]).toContain(
         retPolicy.windows.popup.behavior_protection.message
       );
+
+      expect(retPolicy.mac.behavior_protection.mode).toEqual(defaults.mac.behavior_protection.mode);
+      expect(retPolicy.mac.popup.behavior_protection.enabled).toEqual(
+        defaults.mac.popup.behavior_protection.enabled
+      );
+      expect(retPolicy.mac.popup.behavior_protection.message).not.toEqual(popupMessage);
+
+      // need to invert the test, since it could be either value
+      expect(['', DefaultPolicyNotificationMessage]).toContain(
+        retPolicy.mac.popup.behavior_protection.message
+      );
+
+      expect(retPolicy.linux.behavior_protection.mode).toEqual(
+        defaults.linux.behavior_protection.mode
+      );
+      expect(retPolicy.linux.popup.behavior_protection.enabled).toEqual(
+        defaults.linux.popup.behavior_protection.enabled
+      );
+      expect(retPolicy.linux.popup.behavior_protection.message).not.toEqual(popupMessage);
+
+      // need to invert the test, since it could be either value
+      expect(['', DefaultPolicyNotificationMessage]).toContain(
+        retPolicy.linux.popup.behavior_protection.message
+      );
     });
 
     it('sets ransomware supported field to false when license is below Platinum', () => {
@@ -413,24 +467,40 @@ describe('policy_config and licenses', () => {
       const defaults = policyFactoryWithoutPaidFeatures(); // reference
       const policy = policyFactory(); // what we will modify, and should be reset
       policy.windows.behavior_protection.supported = true;
+      policy.mac.behavior_protection.supported = true;
+      policy.linux.behavior_protection.supported = true;
 
       const retPolicy = unsetPolicyFeaturesAccordingToLicenseLevel(policy, Gold);
 
       expect(retPolicy.windows.behavior_protection.supported).toEqual(
         defaults.windows.behavior_protection.supported
       );
+      expect(retPolicy.mac.behavior_protection.supported).toEqual(
+        defaults.mac.behavior_protection.supported
+      );
+      expect(retPolicy.linux.behavior_protection.supported).toEqual(
+        defaults.linux.behavior_protection.supported
+      );
     });
 
     it('sets behavior_protection supported field to true when license is at Platinum', () => {
       const defaults = policyFactoryWithSupportedFeatures(); // reference
       const policy = policyFactory(); // what we will modify, and should be reset
       policy.windows.behavior_protection.supported = false;
+      policy.mac.behavior_protection.supported = false;
+      policy.linux.behavior_protection.supported = false;
 
       const retPolicy = unsetPolicyFeaturesAccordingToLicenseLevel(policy, Platinum);
 
       expect(retPolicy.windows.behavior_protection.supported).toEqual(
         defaults.windows.behavior_protection.supported
       );
+      expect(retPolicy.mac.behavior_protection.supported).toEqual(
+        defaults.mac.behavior_protection.supported
+      );
+      expect(retPolicy.linux.behavior_protection.supported).toEqual(
+        defaults.linux.behavior_protection.supported
+      );
     });
   });
 
diff --git a/x-pack/plugins/security_solution/common/license/policy_config.ts b/x-pack/plugins/security_solution/common/license/policy_config.ts
index 3b68e2feca6ffa..a684628a7d52c1 100644
--- a/x-pack/plugins/security_solution/common/license/policy_config.ts
+++ b/x-pack/plugins/security_solution/common/license/policy_config.ts
@@ -129,7 +129,9 @@ function isEndpointBehaviorPolicyValidForLicense(policy: PolicyConfig, license:
     // only platinum or higher may enable behavior protection
     if (
       policy.windows.behavior_protection.supported !==
-      defaults.windows.behavior_protection.supported
+        defaults.windows.behavior_protection.supported ||
+      policy.mac.behavior_protection.supported !== defaults.mac.behavior_protection.supported ||
+      policy.linux.behavior_protection.supported !== defaults.linux.behavior_protection.supported
     ) {
       return false;
     }
@@ -139,29 +141,44 @@ function isEndpointBehaviorPolicyValidForLicense(policy: PolicyConfig, license:
   const defaults = policyFactoryWithoutPaidFeatures();
 
   // only platinum or higher may enable behavior_protection
-  if (policy.windows.behavior_protection.mode !== defaults.windows.behavior_protection.mode) {
+  if (
+    policy.windows.behavior_protection.mode !== defaults.windows.behavior_protection.mode ||
+    policy.mac.behavior_protection.mode !== defaults.mac.behavior_protection.mode ||
+    policy.linux.behavior_protection.mode !== defaults.linux.behavior_protection.mode
+  ) {
     return false;
   }
 
   // only platinum or higher may enable behavior_protection notification
   if (
     policy.windows.popup.behavior_protection.enabled !==
-    defaults.windows.popup.behavior_protection.enabled
+      defaults.windows.popup.behavior_protection.enabled ||
+    policy.mac.popup.behavior_protection.enabled !==
+      defaults.mac.popup.behavior_protection.enabled ||
+    policy.linux.popup.behavior_protection.enabled !==
+      defaults.linux.popup.behavior_protection.enabled
   ) {
     return false;
   }
 
   // Only Platinum or higher may change the behavior_protection message (which can be blank or what Endpoint defaults)
   if (
-    policy.windows.popup.behavior_protection.message !== '' &&
-    policy.windows.popup.behavior_protection.message !== DefaultPolicyNotificationMessage
+    (policy.windows.popup.behavior_protection.message !== '' &&
+      policy.windows.popup.behavior_protection.message !== DefaultPolicyNotificationMessage) ||
+    (policy.mac.popup.behavior_protection.message !== '' &&
+      policy.mac.popup.behavior_protection.message !== DefaultPolicyNotificationMessage) ||
+    (policy.linux.popup.behavior_protection.message !== '' &&
+      policy.linux.popup.behavior_protection.message !== DefaultPolicyNotificationMessage)
   ) {
     return false;
   }
 
   // only platinum or higher may enable behavior_protection
   if (
-    policy.windows.behavior_protection.supported !== defaults.windows.behavior_protection.supported
+    policy.windows.behavior_protection.supported !==
+      defaults.windows.behavior_protection.supported ||
+    policy.mac.behavior_protection.supported !== defaults.mac.behavior_protection.supported ||
+    policy.linux.behavior_protection.supported !== defaults.linux.behavior_protection.supported
   ) {
     return false;
   }
diff --git a/x-pack/plugins/security_solution/common/types/timeline/index.ts b/x-pack/plugins/security_solution/common/types/timeline/index.ts
index e7c6464bc15465..6a3d812b1bf5b1 100644
--- a/x-pack/plugins/security_solution/common/types/timeline/index.ts
+++ b/x-pack/plugins/security_solution/common/types/timeline/index.ts
@@ -469,6 +469,7 @@ export type TimelineExpandedEventType =
       params?: {
         eventId: string;
         indexName: string;
+        refetch?: () => void;
       };
     }
   | EmptyObject;
diff --git a/x-pack/plugins/security_solution/cypress/ccs_integration/detection_alerts/alerts_details.spec.ts b/x-pack/plugins/security_solution/cypress/ccs_integration/detection_alerts/alerts_details.spec.ts
index 24de882bdfb905..26f2385d94f1fd 100644
--- a/x-pack/plugins/security_solution/cypress/ccs_integration/detection_alerts/alerts_details.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/ccs_integration/detection_alerts/alerts_details.spec.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { CELL_TEXT, JSON_LINES, TABLE_ROWS } from '../../screens/alerts_details';
+import { ALERT_FLYOUT, CELL_TEXT, JSON_LINES, TABLE_ROWS } from '../../screens/alerts_details';
 
 import {
   expandFirstAlert,
@@ -45,24 +45,27 @@ describe('Alert details with unmapped fields', () => {
     openJsonView();
     scrollJsonViewToBottom();
 
-    cy.get(JSON_LINES).then((elements) => {
-      const length = elements.length;
-      cy.wrap(elements)
-        .eq(length - expectedUnmappedField.line)
-        .should('have.text', expectedUnmappedField.text);
-    });
+    cy.get(ALERT_FLYOUT)
+      .find(JSON_LINES)
+      .then((elements) => {
+        const length = elements.length;
+        cy.wrap(elements)
+          .eq(length - expectedUnmappedField.line)
+          .invoke('text')
+          .should('include', expectedUnmappedField.text);
+      });
   });
 
   it('Displays the unmapped field on the table', () => {
     const expectedUnmmappedField = {
-      row: 55,
+      row: 88,
       field: 'unmapped',
       text: 'This is the unmapped field',
     };
 
     openTable();
-
-    cy.get(TABLE_ROWS)
+    cy.get(ALERT_FLYOUT)
+      .find(TABLE_ROWS)
       .eq(expectedUnmmappedField.row)
       .within(() => {
         cy.get(CELL_TEXT).eq(2).should('have.text', expectedUnmmappedField.field);
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
index dda86d2717386c..10ebae84365f56 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
@@ -47,13 +47,14 @@ describe('Alert details with unmapped fields', () => {
         const length = elements.length;
         cy.wrap(elements)
           .eq(length - expectedUnmappedField.line)
-          .should('have.text', expectedUnmappedField.text);
+          .invoke('text')
+          .should('include', expectedUnmappedField.text);
       });
   });
 
   it('Displays the unmapped field on the table', () => {
     const expectedUnmmappedField = {
-      row: 55,
+      row: 88,
       field: 'unmapped',
       text: 'This is the unmapped field',
     };
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts
index 4c4810c5daf311..8e82394da1db80 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts
@@ -89,7 +89,8 @@ describe('CTI Enrichment', () => {
       expectedEnrichment.forEach((enrichment) => {
         cy.wrap(elements)
           .eq(length - enrichment.line)
-          .should('have.text', enrichment.text);
+          .invoke('text')
+          .should('include', enrichment.text);
       });
     });
   });
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_rules/custom_query_rule.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_rules/custom_query_rule.spec.ts
index 10ed18eb91d0cc..7d833b134ddd7f 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_rules/custom_query_rule.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_rules/custom_query_rule.spec.ts
@@ -238,10 +238,9 @@ describe('Custom detection rules deletion and edition', () => {
       goToManageAlertsDetectionRules();
       waitForAlertsIndexToBeCreated();
       createCustomRuleActivated(getNewRule(), 'rule1');
-      createCustomRuleActivated(getNewRule(), 'rule2');
 
-      createCustomRuleActivated(getNewOverrideRule(), 'rule3');
-      createCustomRuleActivated(getExistingRule(), 'rule4');
+      createCustomRuleActivated(getNewOverrideRule(), 'rule2');
+      createCustomRuleActivated(getExistingRule(), 'rule3');
       reload();
     });
 
@@ -295,7 +294,7 @@ describe('Custom detection rules deletion and edition', () => {
           });
           cy.get(SHOWING_RULES_TEXT).should(
             'have.text',
-            `Showing ${expectedNumberOfRulesAfterDeletion} rules`
+            `Showing ${expectedNumberOfRulesAfterDeletion} rule`
           );
           cy.get(CUSTOM_RULES_BTN).should(
             'have.text',
diff --git a/x-pack/plugins/security_solution/cypress/screens/alerts.ts b/x-pack/plugins/security_solution/cypress/screens/alerts.ts
index 30fd5bd801182a..e0430fb402769d 100644
--- a/x-pack/plugins/security_solution/cypress/screens/alerts.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/alerts.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-export const ADD_EXCEPTION_BTN = '[data-test-subj="addExceptionButton"]';
+export const ADD_EXCEPTION_BTN = '[data-test-subj="add-exception-menu-item"]';
 
 export const ALERTS = '[data-test-subj="events-viewer-panel"] [data-test-subj="event"]';
 
diff --git a/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts b/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts
index 2449a90f5328c4..5307ebc267efc9 100644
--- a/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts
@@ -9,9 +9,11 @@ export const ALERT_FLYOUT = '[data-test-subj="timeline:details-panel:flyout"]';
 
 export const CELL_TEXT = '.euiText';
 
+export const JSON_VIEW_WRAPPER = '[data-test-subj="jsonViewWrapper"]';
+
 export const JSON_CONTENT = '[data-test-subj="jsonView"]';
 
-export const JSON_LINES = '.ace_line';
+export const JSON_LINES = '.euiCodeBlock__line';
 
 export const JSON_VIEW_TAB = '[data-test-subj="jsonViewTab"]';
 
diff --git a/x-pack/plugins/security_solution/cypress/tasks/alerts_details.ts b/x-pack/plugins/security_solution/cypress/tasks/alerts_details.ts
index f7f7f72e83d410..091a483399adad 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/alerts_details.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/alerts_details.ts
@@ -7,7 +7,7 @@
 
 import {
   ENRICHMENT_COUNT_NOTIFICATION,
-  JSON_CONTENT,
+  JSON_VIEW_WRAPPER,
   JSON_VIEW_TAB,
   TABLE_TAB,
 } from '../screens/alerts_details';
@@ -25,7 +25,7 @@ export const openThreatIndicatorDetails = () => {
 };
 
 export const scrollJsonViewToBottom = () => {
-  cy.get(JSON_CONTENT).click({ force: true });
-  cy.get(JSON_CONTENT).type('{pagedown}{pagedown}{pagedown}');
-  cy.get(JSON_CONTENT).should('be.visible');
+  cy.get(JSON_VIEW_WRAPPER).click({ force: true });
+  cy.get(JSON_VIEW_WRAPPER).type('{pagedown}{pagedown}{pagedown}');
+  cy.get(JSON_VIEW_WRAPPER).should('be.visible');
 };
diff --git a/x-pack/plugins/security_solution/cypress/tasks/login.ts b/x-pack/plugins/security_solution/cypress/tasks/login.ts
index 2eba6aba0c5e22..243bfd113bfd23 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/login.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/login.ts
@@ -205,11 +205,6 @@ const credentialsProvidedByEnvironment = (): boolean =>
  * Kibana's `/internal/security/login` endpoint, bypassing the login page (for speed).
  */
 const loginViaEnvironmentCredentials = () => {
-  const providerName =
-    Cypress.env('protocol') === 'http' || Cypress.config().baseUrl!.includes('staging')
-      ? 'basic'
-      : 'cloud-basic';
-
   cy.log(
     `Authenticating via environment credentials from the \`CYPRESS_${ELASTICSEARCH_USERNAME}\` and \`CYPRESS_${ELASTICSEARCH_PASSWORD}\` environment variables`
   );
@@ -218,7 +213,7 @@ const loginViaEnvironmentCredentials = () => {
   cy.request({
     body: {
       providerType: 'basic',
-      providerName,
+      providerName: 'basic',
       currentURL: '/',
       params: {
         username: Cypress.env(ELASTICSEARCH_USERNAME),
diff --git a/x-pack/plugins/security_solution/public/cases/components/case_view/index.tsx b/x-pack/plugins/security_solution/public/cases/components/case_view/index.tsx
index 10a9e27fee1cfc..fdb12170309c7a 100644
--- a/x-pack/plugins/security_solution/public/cases/components/case_view/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/case_view/index.tsx
@@ -7,8 +7,6 @@
 
 import React, { useCallback, useRef, useState } from 'react';
 import { useDispatch } from 'react-redux';
-import { SearchResponse } from 'elasticsearch';
-import { isEmpty } from 'lodash';
 
 import {
   getCaseDetailsUrl,
@@ -18,18 +16,17 @@ import {
   getRuleDetailsUrl,
   useFormatUrl,
 } from '../../../common/components/link_to';
-import { Ecs } from '../../../../common/ecs';
 import { Case, CaseViewRefreshPropInterface } from '../../../../../cases/common';
 import { TimelineId } from '../../../../common/types/timeline';
 import { SecurityPageName } from '../../../app/types';
-import { KibanaServices, useKibana } from '../../../common/lib/kibana';
-import { APP_ID, DETECTION_ENGINE_QUERY_SIGNALS_URL } from '../../../../common/constants';
+import { useKibana } from '../../../common/lib/kibana';
+import { APP_ID } from '../../../../common/constants';
 import { timelineActions } from '../../../timelines/store/timeline';
 import { useSourcererScope } from '../../../common/containers/sourcerer';
 import { SourcererScopeName } from '../../../common/store/sourcerer/model';
 import { DetailsPanel } from '../../../timelines/components/side_panel';
 import { InvestigateInTimelineAction } from '../../../detections/components/alerts_table/timeline_actions/investigate_in_timeline_action';
-import { buildAlertsQuery, formatAlertToEcsSignal, useFetchAlertData } from './helpers';
+import { useFetchAlertData } from './helpers';
 import { SEND_ALERT_TO_TIMELINE } from './translations';
 import { useInsertTimeline } from '../use_insert_timeline';
 import { SpyRoute } from '../../../common/utils/route/spy_routes';
@@ -70,39 +67,12 @@ const TimelineDetailsPanel = () => {
 };
 
 const InvestigateInTimelineActionComponent = (alertIds: string[]) => {
-  const fetchEcsAlertsData = async (fetchAlertIds?: string[]): Promise<Ecs[]> => {
-    if (isEmpty(fetchAlertIds)) {
-      return [];
-    }
-    const alertResponse = await KibanaServices.get().http.fetch<
-      SearchResponse<{ '@timestamp': string; [key: string]: unknown }>
-    >(DETECTION_ENGINE_QUERY_SIGNALS_URL, {
-      method: 'POST',
-      body: JSON.stringify(buildAlertsQuery(fetchAlertIds ?? [])),
-    });
-    return (
-      alertResponse?.hits.hits.reduce<Ecs[]>(
-        (acc, { _id, _index, _source }) => [
-          ...acc,
-          {
-            ...formatAlertToEcsSignal(_source as {}),
-            _id,
-            _index,
-            timestamp: _source['@timestamp'],
-          },
-        ],
-        []
-      ) ?? []
-    );
-  };
-
   return (
     <InvestigateInTimelineAction
       ariaLabel={SEND_ALERT_TO_TIMELINE}
       alertIds={alertIds}
       key="investigate-in-timeline"
       ecsRowData={null}
-      fetchEcsAlertsData={fetchEcsAlertsData}
       nonEcsRowData={[]}
     />
   );
diff --git a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx
index 2a3484318966f9..f906d1cac0153f 100644
--- a/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/alerts_viewer/alerts_table.tsx
@@ -15,6 +15,7 @@ import { alertsDefaultModel } from './default_headers';
 import { defaultRowRenderers } from '../../../timelines/components/timeline/body/renderers';
 import { DefaultCellRenderer } from '../../../timelines/components/timeline/cell_rendering/default_cell_renderer';
 import * as i18n from './translations';
+import { defaultCellActions } from '../../lib/cell_actions/default_cell_actions';
 import { useKibana } from '../../lib/kibana';
 import { SourcererScopeName } from '../../store/sourcerer/model';
 import { useIsExperimentalFeatureEnabled } from '../../hooks/use_experimental_features';
@@ -104,6 +105,7 @@ const AlertsTableComponent: React.FC<Props> = ({
     <StatefulEventsViewer
       pageFilters={alertsFilter}
       defaultModel={alertsDefaultModel}
+      defaultCellActions={defaultCellActions}
       end={endDate}
       id={timelineId}
       renderCellValue={DefaultCellRenderer}
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap
index 0412b3074e3f17..d4e839c4bef77e 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap
@@ -2,54 +2,50 @@
 
 exports[`JSON View rendering should match snapshot 1`] = `
 <styled.div>
-  <EuiCodeEditor
+  <EuiCodeBlock
     data-test-subj="jsonView"
-    height="100%"
-    isReadOnly={true}
-    mode="javascript"
-    setOptions={
-      Object {
-        "fontSize": "12px",
-      }
-    }
-    value="{
-  \\"_id\\": \\"pEMaMmkBUV60JmNWmWVi\\",
-  \\"_index\\": \\"filebeat-8.0.0-2019.02.19-000001\\",
-  \\"_score\\": 1,
-  \\"_type\\": \\"_doc\\",
-  \\"@timestamp\\": \\"2019-02-28T16:50:54.621Z\\",
-  \\"agent\\": {
-    \\"ephemeral_id\\": \\"9d391ef2-a734-4787-8891-67031178c641\\",
-    \\"hostname\\": \\"siem-kibana\\",
-    \\"id\\": \\"5de03d5f-52f3-482e-91d4-853c7de073c3\\",
-    \\"type\\": \\"filebeat\\",
-    \\"version\\": \\"8.0.0\\"
+    fontSize="m"
+    isCopyable={true}
+    language="json"
+    paddingSize="m"
+  >
+    {
+  "_id": "pEMaMmkBUV60JmNWmWVi",
+  "_index": "filebeat-8.0.0-2019.02.19-000001",
+  "_score": 1,
+  "_type": "_doc",
+  "@timestamp": "2019-02-28T16:50:54.621Z",
+  "agent": {
+    "ephemeral_id": "9d391ef2-a734-4787-8891-67031178c641",
+    "hostname": "siem-kibana",
+    "id": "5de03d5f-52f3-482e-91d4-853c7de073c3",
+    "type": "filebeat",
+    "version": "8.0.0"
   },
-  \\"cloud\\": {
-    \\"availability_zone\\": \\"projects/189716325846/zones/us-east1-b\\",
-    \\"instance\\": {
-      \\"id\\": \\"5412578377715150143\\",
-      \\"name\\": \\"siem-kibana\\"
+  "cloud": {
+    "availability_zone": "projects/189716325846/zones/us-east1-b",
+    "instance": {
+      "id": "5412578377715150143",
+      "name": "siem-kibana"
     },
-    \\"machine\\": {
-      \\"type\\": \\"projects/189716325846/machineTypes/n1-standard-1\\"
+    "machine": {
+      "type": "projects/189716325846/machineTypes/n1-standard-1"
     },
-    \\"project\\": {
-      \\"id\\": \\"elastic-beats\\"
+    "project": {
+      "id": "elastic-beats"
     },
-    \\"provider\\": \\"gce\\"
+    "provider": "gce"
   },
-  \\"destination\\": {
-    \\"bytes\\": 584,
-    \\"ip\\": \\"10.47.8.200\\",
-    \\"packets\\": 4,
-    \\"port\\": 902
+  "destination": {
+    "bytes": 584,
+    "ip": "10.47.8.200",
+    "packets": 4,
+    "port": 902
   },
-  \\"event\\": {
-    \\"kind\\": \\"event\\"
+  "event": {
+    "kind": "event"
   }
-}"
-    width="100%"
-  />
+}
+  </EuiCodeBlock>
 </styled.div>
 `;
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
index 1d639eb9497fcc..3b5519825f9961 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
@@ -245,7 +245,7 @@ const EventDetailsComponent: React.FC<Props> = ({
       content: (
         <>
           <EuiSpacer size="m" />
-          <TabContentWrapper>
+          <TabContentWrapper data-test-subj="jsonViewWrapper">
             <JsonView data={data} />
           </TabContentWrapper>
         </>
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx
index c9ca93582cd9a2..0614f131bcd101 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { EuiCodeEditor } from '@elastic/eui';
+import { EuiCodeBlock } from '@elastic/eui';
 import { set } from '@elastic/safer-lodash-set/fp';
 import React, { useMemo } from 'react';
 import styled from 'styled-components';
@@ -23,8 +23,6 @@ const EuiCodeEditorContainer = styled.div`
   }
 `;
 
-const EDITOR_SET_OPTIONS = { fontSize: '12px' };
-
 export const JsonView = React.memo<Props>(({ data }) => {
   const value = useMemo(
     () =>
@@ -38,15 +36,15 @@ export const JsonView = React.memo<Props>(({ data }) => {
 
   return (
     <EuiCodeEditorContainer>
-      <EuiCodeEditor
+      <EuiCodeBlock
+        language="json"
+        fontSize="m"
+        paddingSize="m"
+        isCopyable
         data-test-subj="jsonView"
-        isReadOnly
-        mode="javascript"
-        setOptions={EDITOR_SET_OPTIONS}
-        value={value}
-        width="100%"
-        height="100%"
-      />
+      >
+        {value}
+      </EuiCodeBlock>
     </EuiCodeEditorContainer>
   );
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
index e324a54745c25d..e3dea824d29ef2 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
@@ -29,6 +29,7 @@ import { defaultRowRenderers } from '../../../timelines/components/timeline/body
 import { DefaultCellRenderer } from '../../../timelines/components/timeline/cell_rendering/default_cell_renderer';
 import { useTimelineEvents } from '../../../timelines/containers';
 import { useIsExperimentalFeatureEnabled } from '../../hooks/use_experimental_features';
+import { defaultCellActions } from '../../lib/cell_actions/default_cell_actions';
 
 jest.mock('../../lib/kibana');
 
@@ -124,6 +125,7 @@ describe('EventsViewer', () => {
   const mount = useMountAppended();
 
   let testProps = {
+    defaultCellActions,
     defaultModel: eventsDefaultModel,
     end: to,
     id: TimelineId.test,
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.test.tsx
index 571e04a106cf0b..743c1894db2e3b 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.test.tsx
@@ -21,6 +21,7 @@ import { SourcererScopeName } from '../../store/sourcerer/model';
 import { DefaultCellRenderer } from '../../../timelines/components/timeline/cell_rendering/default_cell_renderer';
 import { useTimelineEvents } from '../../../timelines/containers';
 import { defaultRowRenderers } from '../../../timelines/components/timeline/body/renderers';
+import { defaultCellActions } from '../../lib/cell_actions/default_cell_actions';
 
 jest.mock('../../../common/lib/kibana');
 
@@ -38,6 +39,7 @@ const from = '2019-08-27T22:10:56.794Z';
 const to = '2019-08-26T22:10:56.791Z';
 
 const testProps = {
+  defaultCellActions,
   defaultModel: eventsDefaultModel,
   end: to,
   indexNames: [],
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
index 4b91122103d16a..8a8ebd18174be4 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
@@ -23,6 +23,7 @@ import { useGlobalFullScreen } from '../../containers/use_full_screen';
 import { useIsExperimentalFeatureEnabled } from '../../hooks/use_experimental_features';
 import { SourcererScopeName } from '../../store/sourcerer/model';
 import { useSourcererScope } from '../../containers/sourcerer';
+import { TGridCellAction } from '../../../../../timelines/common/types';
 import { DetailsPanel } from '../../../timelines/components/side_panel';
 import { CellValueElementProps } from '../../../timelines/components/timeline/cell_rendering';
 import { useKibana } from '../../lib/kibana';
@@ -47,6 +48,7 @@ const FullScreenContainer = styled.div<{ $isFullScreen: boolean }>`
 `;
 
 export interface OwnProps {
+  defaultCellActions?: TGridCellAction[];
   defaultModel: SubsetTimelineModel;
   end: string;
   id: TimelineId;
@@ -73,6 +75,7 @@ const StatefulEventsViewerComponent: React.FC<Props> = ({
   createTimeline,
   columns,
   dataProviders,
+  defaultCellActions,
   deletedEventIds,
   deleteEventQuery,
   end,
@@ -140,6 +143,7 @@ const StatefulEventsViewerComponent: React.FC<Props> = ({
               browserFields,
               columns,
               dataProviders: dataProviders!,
+              defaultCellActions,
               deletedEventIds,
               docValueFields,
               end,
@@ -269,6 +273,7 @@ export const StatefulEventsViewer = connector(
       prevProps.scopeId === nextProps.scopeId &&
       deepEqual(prevProps.columns, nextProps.columns) &&
       deepEqual(prevProps.dataProviders, nextProps.dataProviders) &&
+      prevProps.defaultCellActions === nextProps.defaultCellActions &&
       deepEqual(prevProps.excludedRowRendererIds, nextProps.excludedRowRendererIds) &&
       prevProps.deletedEventIds === nextProps.deletedEventIds &&
       prevProps.end === nextProps.end &&
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx
index e4a015525dfb44..bf336c00f94d21 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.test.tsx
@@ -6,6 +6,7 @@
  */
 
 import { act, renderHook, RenderHookResult } from '@testing-library/react-hooks';
+import type { estypes } from '@elastic/elasticsearch';
 import { coreMock } from '../../../../../../../src/core/public/mocks';
 import { KibanaServices } from '../../../common/lib/kibana';
 
@@ -28,7 +29,6 @@ import {
   ReturnUseAddOrUpdateException,
   AddOrUpdateExceptionItemsFunc,
 } from './use_add_exception';
-import { UpdateDocumentByQueryResponse } from 'elasticsearch';
 
 const mockKibanaHttpService = coreMock.createStart().http;
 const mockKibanaServices = KibanaServices.get as jest.Mock;
@@ -39,7 +39,7 @@ const fetchMock = jest.fn();
 mockKibanaServices.mockReturnValue({ http: { fetch: fetchMock } });
 
 describe('useAddOrUpdateException', () => {
-  let updateAlertStatus: jest.SpyInstance<Promise<UpdateDocumentByQueryResponse>>;
+  let updateAlertStatus: jest.SpyInstance<Promise<estypes.UpdateByQueryResponse>>;
   let addExceptionListItem: jest.SpyInstance<Promise<ExceptionListItemSchema>>;
   let updateExceptionListItem: jest.SpyInstance<Promise<ExceptionListItemSchema>>;
   let getQueryFilter: jest.SpyInstance<ReturnType<typeof getQueryFilterHelper.getQueryFilter>>;
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx
index dbae0964b41a8c..722632e88377d9 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/use_add_exception.tsx
@@ -6,7 +6,7 @@
  */
 
 import { useEffect, useRef, useState, useCallback } from 'react';
-import { UpdateDocumentByQueryResponse } from 'elasticsearch';
+import type { estypes } from '@elastic/elasticsearch';
 import type {
   ExceptionListItemSchema,
   CreateExceptionListItemSchema,
@@ -120,8 +120,8 @@ export const useAddOrUpdateException = ({
 
       try {
         setIsLoading(true);
-        let alertIdResponse: UpdateDocumentByQueryResponse | undefined;
-        let bulkResponse: UpdateDocumentByQueryResponse | undefined;
+        let alertIdResponse: estypes.UpdateByQueryResponse | undefined;
+        let bulkResponse: estypes.UpdateByQueryResponse | undefined;
         if (alertIdToClose != null) {
           alertIdResponse = await updateAlertStatus({
             query: getUpdateAlertsQuery([alertIdToClose]),
diff --git a/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx b/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx
index 20bb4f51c075b0..28ff98d5c9c880 100644
--- a/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx
@@ -32,7 +32,7 @@ export const HelpMenu = React.memo(() => {
           content: i18n.translate('xpack.securitySolution.chrome.helpMenu.documentation.ecs', {
             defaultMessage: 'ECS documentation',
           }),
-          href: `${docLinks.ELASTIC_WEBSITE_URL}guide/en/ecs/current/index.html`,
+          href: docLinks.links.ecs.guide,
           iconType: 'documents',
           linkType: 'custom',
           target: '_blank',
diff --git a/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.tsx b/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.tsx
index 0fc8a740845213..89505cfeca75a0 100644
--- a/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.tsx
@@ -6,7 +6,7 @@
  */
 
 import React, { useMemo } from 'react';
-import { EuiButtonIcon, EuiPopover, EuiToolTip } from '@elastic/eui';
+import { EuiButtonEmpty, EuiButtonIcon, EuiPopover, EuiToolTip } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { StatefulTopN } from '../../top_n';
 import { TimelineId } from '../../../../../common/types/timeline';
@@ -23,17 +23,30 @@ const SHOW_TOP = (fieldName: string) =>
   });
 
 interface Props {
+  /** `Component` is only used with `EuiDataGrid`; the grid keeps a reference to `Component` for show / hide functionality */
+  Component?: typeof EuiButtonEmpty | typeof EuiButtonIcon;
   field: string;
   onClick: () => void;
   onFilterAdded?: () => void;
   ownFocus: boolean;
   showTopN: boolean;
+  showTooltip?: boolean;
   timelineId?: string | null;
   value?: string[] | string | null;
 }
 
 export const ShowTopNButton: React.FC<Props> = React.memo(
-  ({ field, onClick, onFilterAdded, ownFocus, showTopN, timelineId, value }) => {
+  ({
+    Component,
+    field,
+    onClick,
+    onFilterAdded,
+    ownFocus,
+    showTooltip = true,
+    showTopN,
+    timelineId,
+    value,
+  }) => {
     const activeScope: SourcererScopeName =
       timelineId === TimelineId.active
         ? SourcererScopeName.timeline
@@ -44,19 +57,32 @@ export const ShowTopNButton: React.FC<Props> = React.memo(
         ? SourcererScopeName.detections
         : SourcererScopeName.default;
     const { browserFields, indexPattern } = useSourcererScope(activeScope);
+
     const button = useMemo(
-      () => (
-        <EuiButtonIcon
-          aria-label={SHOW_TOP(field)}
-          className="securitySolution__hoverActionButton"
-          data-test-subj="show-top-field"
-          iconSize="s"
-          iconType="visBarVertical"
-          onClick={onClick}
-        />
-      ),
-      [field, onClick]
+      () =>
+        Component ? (
+          <Component
+            aria-label={SHOW_TOP(field)}
+            data-test-subj="show-top-field"
+            iconType="visBarVertical"
+            onClick={onClick}
+            title={SHOW_TOP(field)}
+          >
+            {SHOW_TOP(field)}
+          </Component>
+        ) : (
+          <EuiButtonIcon
+            aria-label={SHOW_TOP(field)}
+            className="securitySolution__hoverActionButton"
+            data-test-subj="show-top-field"
+            iconSize="s"
+            iconType="visBarVertical"
+            onClick={onClick}
+          />
+        ),
+      [Component, field, onClick]
     );
+
     return showTopN ? (
       <EuiPopover button={button} isOpen={showTopN} closePopover={onClick}>
         <StatefulTopN
@@ -69,7 +95,7 @@ export const ShowTopNButton: React.FC<Props> = React.memo(
           value={value}
         />
       </EuiPopover>
-    ) : (
+    ) : showTooltip ? (
       <EuiToolTip
         content={
           <TooltipWithKeyboardShortcut
@@ -85,6 +111,8 @@ export const ShowTopNButton: React.FC<Props> = React.memo(
       >
         {button}
       </EuiToolTip>
+    ) : (
+      button
     );
   }
 );
diff --git a/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_popover.tsx b/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_popover.tsx
index cc6ac5355f90b8..d7d62d82a95b04 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_popover.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_popover.tsx
@@ -197,7 +197,7 @@ export const MlPopover = React.memo(() => {
                     values={{
                       mlDocs: (
                         <a
-                          href={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/security/${docLinks.DOC_LINK_VERSION}/machine-learning.html`}
+                          href={`${docLinks.links.siem.ml}`}
                           rel="noopener noreferrer"
                           target="_blank"
                         >
diff --git a/x-pack/plugins/security_solution/public/common/lib/cell_actions/default_cell_actions.tsx b/x-pack/plugins/security_solution/public/common/lib/cell_actions/default_cell_actions.tsx
new file mode 100644
index 00000000000000..951d921653c150
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/lib/cell_actions/default_cell_actions.tsx
@@ -0,0 +1,178 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useCallback, useState, useMemo } from 'react';
+
+import type {
+  BrowserFields,
+  TimelineNonEcsData,
+} from '../../../../../timelines/common/search_strategy';
+import { DataProvider, TGridCellAction } from '../../../../../timelines/common/types';
+import { TimelineId } from '../../../../common';
+import { getMappedNonEcsValue } from '../../../timelines/components/timeline/body/data_driven_columns';
+import { IS_OPERATOR } from '../../../timelines/components/timeline/data_providers/data_provider';
+import { allowTopN, escapeDataProviderId } from '../../components/drag_and_drop/helpers';
+import { ShowTopNButton } from '../../components/hover_actions/actions/show_top_n';
+import { getAllFieldsByName } from '../../containers/source';
+import { useKibana } from '../kibana';
+
+/** a noop required by the filter in / out buttons */
+const onFilterAdded = () => {};
+
+/** a hook to eliminate the verbose boilerplate required to use common services */
+const useKibanaServices = () => {
+  const {
+    timelines,
+    data: {
+      query: { filterManager },
+    },
+  } = useKibana().services;
+
+  return { timelines, filterManager };
+};
+
+/** the default actions shown in `EuiDataGrid` cells */
+export const defaultCellActions: TGridCellAction[] = [
+  ({ data }: { data: TimelineNonEcsData[][] }) => ({ rowIndex, columnId, Component }) => {
+    const { timelines, filterManager } = useKibanaServices();
+
+    const value = getMappedNonEcsValue({
+      data: data[rowIndex],
+      fieldName: columnId,
+    });
+
+    return (
+      <>
+        {timelines.getHoverActions().getFilterForValueButton({
+          Component,
+          field: columnId,
+          filterManager,
+          onFilterAdded,
+          ownFocus: false,
+          showTooltip: false,
+          value,
+        })}
+      </>
+    );
+  },
+  ({ data }: { data: TimelineNonEcsData[][] }) => ({ rowIndex, columnId, Component }) => {
+    const { timelines, filterManager } = useKibanaServices();
+
+    const value = getMappedNonEcsValue({
+      data: data[rowIndex],
+      fieldName: columnId,
+    });
+
+    return (
+      <>
+        {timelines.getHoverActions().getFilterOutValueButton({
+          Component,
+          field: columnId,
+          filterManager,
+          onFilterAdded,
+          ownFocus: false,
+          showTooltip: false,
+          value,
+        })}
+      </>
+    );
+  },
+  ({ data }: { data: TimelineNonEcsData[][] }) => ({ rowIndex, columnId, Component }) => {
+    const { timelines } = useKibanaServices();
+
+    const value = getMappedNonEcsValue({
+      data: data[rowIndex],
+      fieldName: columnId,
+    });
+
+    const dataProvider: DataProvider[] = useMemo(
+      () =>
+        value?.map((x) => ({
+          and: [],
+          enabled: true,
+          id: `${escapeDataProviderId(columnId)}-row-${rowIndex}-col-${columnId}-val-${x}`,
+          name: x,
+          excluded: false,
+          kqlQuery: '',
+          queryMatch: {
+            field: columnId,
+            value: x,
+            operator: IS_OPERATOR,
+          },
+        })) ?? [],
+      [columnId, rowIndex, value]
+    );
+
+    return (
+      <>
+        {timelines.getHoverActions().getAddToTimelineButton({
+          Component,
+          dataProvider,
+          field: columnId,
+          ownFocus: false,
+          showTooltip: false,
+        })}
+      </>
+    );
+  },
+  ({ browserFields, data }: { browserFields: BrowserFields; data: TimelineNonEcsData[][] }) => ({
+    rowIndex,
+    columnId,
+    Component,
+  }) => {
+    const [showTopN, setShowTopN] = useState(false);
+    const onClick = useCallback(() => setShowTopN(!showTopN), [showTopN]);
+
+    const value = getMappedNonEcsValue({
+      data: data[rowIndex],
+      fieldName: columnId,
+    });
+
+    return (
+      <>
+        {allowTopN({
+          browserField: getAllFieldsByName(browserFields)[columnId],
+          fieldName: columnId,
+        }) && (
+          <ShowTopNButton
+            Component={Component}
+            data-test-subj="hover-actions-show-top-n"
+            field={columnId}
+            onClick={onClick}
+            onFilterAdded={onFilterAdded}
+            ownFocus={false}
+            showTopN={showTopN}
+            showTooltip={false}
+            timelineId={TimelineId.active}
+            value={value}
+          />
+        )}
+      </>
+    );
+  },
+  ({ data }: { data: TimelineNonEcsData[][] }) => ({ rowIndex, columnId, Component }) => {
+    const { timelines } = useKibanaServices();
+
+    const value = getMappedNonEcsValue({
+      data: data[rowIndex],
+      fieldName: columnId,
+    });
+
+    return (
+      <>
+        {timelines.getHoverActions().getCopyButton({
+          Component,
+          field: columnId,
+          isHoverAction: false,
+          ownFocus: false,
+          showTooltip: false,
+          value,
+        })}
+      </>
+    );
+  },
+];
diff --git a/x-pack/plugins/security_solution/public/common/store/app/reducer.ts b/x-pack/plugins/security_solution/public/common/store/app/reducer.ts
index 5b0a2330a408d0..6ab572490f5d7f 100644
--- a/x-pack/plugins/security_solution/public/common/store/app/reducer.ts
+++ b/x-pack/plugins/security_solution/public/common/store/app/reducer.ts
@@ -19,6 +19,7 @@ export const initialAppState: AppState = {
   errors: [],
   enableExperimental: {
     trustedAppsByPolicyEnabled: false,
+    excludePoliciesInFilterEnabled: false,
     metricsEntitiesEnabled: false,
     ruleRegistryEnabled: false,
     tGridEnabled: false,
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
index 245aa67d677be4..d48bc95f5d480a 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
@@ -94,7 +94,7 @@ export const updateAlertStatusAction = async ({
     // TODO: Only delete those that were successfully updated from updatedRules
     setEventsDeleted({ eventIds: alertIds, isDeleted: true });
 
-    if (response.version_conflicts > 0 && alertIds.length === 1) {
+    if (response.version_conflicts && alertIds.length === 1) {
       throw new Error(
         i18n.translate(
           'xpack.securitySolution.detectionEngine.alerts.updateAlertStatusFailedSingleAlert',
@@ -105,7 +105,11 @@ export const updateAlertStatusAction = async ({
       );
     }
 
-    onAlertStatusUpdateSuccess(response.updated, response.version_conflicts, selectedStatus);
+    onAlertStatusUpdateSuccess(
+      response.updated ?? 0,
+      response.version_conflicts ?? 0,
+      selectedStatus
+    );
   } catch (error) {
     onAlertStatusUpdateFailure(selectedStatus, error);
   } finally {
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
index 4b91e3b1e35fce..a1f2025c6c0d5d 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
@@ -53,6 +53,7 @@ import { defaultRowRenderers } from '../../../timelines/components/timeline/body
 import { columns, RenderCellValue } from '../../configurations/security_solution_detections';
 import { useInvalidFilterQuery } from '../../../common/hooks/use_invalid_filter_query';
 import { DEFAULT_COLUMN_MIN_WIDTH } from '../../../timelines/components/timeline/body/constants';
+import { defaultCellActions } from '../../../common/lib/cell_actions/default_cell_actions';
 
 interface OwnProps {
   defaultFilters?: Filter[];
@@ -388,6 +389,7 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
   return (
     <StatefulEventsViewer
       pageFilters={defaultFiltersMemo}
+      defaultCellActions={defaultCellActions}
       defaultModel={defaultTimelineModel}
       end={to}
       currentFilter={filterGroup}
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/add_endpoint_exception.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/add_endpoint_exception.tsx
new file mode 100644
index 00000000000000..23709269a4c13e
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/add_endpoint_exception.tsx
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiContextMenuItem, EuiText } from '@elastic/eui';
+import React from 'react';
+import * as i18n from '../translations';
+
+interface AddEndpointExceptionProps {
+  onClick: () => void;
+  disabled?: boolean;
+}
+
+const AddEndpointExceptionComponent: React.FC<AddEndpointExceptionProps> = ({
+  onClick,
+  disabled,
+}) => {
+  return (
+    <EuiContextMenuItem
+      key="add-endpoint-exception-menu-item"
+      aria-label={i18n.ACTION_ADD_ENDPOINT_EXCEPTION}
+      data-test-subj="add-endpoint-exception-menu-item"
+      id="addEndpointException"
+      onClick={onClick}
+      disabled={disabled}
+    >
+      <EuiText size="m">{i18n.ACTION_ADD_ENDPOINT_EXCEPTION}</EuiText>
+    </EuiContextMenuItem>
+  );
+};
+
+export const AddEndpointException = React.memo(AddEndpointExceptionComponent);
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/add_event_filter.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/add_event_filter.tsx
new file mode 100644
index 00000000000000..1104b3eb830815
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/add_event_filter.tsx
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiContextMenuItem, EuiText } from '@elastic/eui';
+import React from 'react';
+import * as i18n from '../translations';
+
+interface AddEventFilterProps {
+  onClick: () => void;
+  disabled?: boolean;
+}
+
+const AddEventFilterComponent: React.FC<AddEventFilterProps> = ({ onClick, disabled }) => {
+  return (
+    <EuiContextMenuItem
+      key="add-event-filter-menu-item"
+      aria-label={i18n.ACTION_ADD_EVENT_FILTER}
+      data-test-subj="add-event-filter-menu-item"
+      id="addEventFilter"
+      onClick={onClick}
+      disabled={disabled}
+    >
+      <EuiText data-test-subj="addEventFilterButton" size="m">
+        {i18n.ACTION_ADD_EVENT_FILTER}
+      </EuiText>
+    </EuiContextMenuItem>
+  );
+};
+
+export const AddEventFilter = React.memo(AddEventFilterComponent);
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/add_exception.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/add_exception.tsx
new file mode 100644
index 00000000000000..030f67c9e708c8
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/add_exception.tsx
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiContextMenuItem, EuiText } from '@elastic/eui';
+import React from 'react';
+import * as i18n from '../translations';
+
+interface AddExceptionProps {
+  disabled?: boolean;
+  onClick: () => void;
+}
+
+const AddExceptionComponent: React.FC<AddExceptionProps> = ({ disabled, onClick }) => {
+  return (
+    <EuiContextMenuItem
+      key="add-exception-menu-item"
+      aria-label={i18n.ACTION_ADD_EXCEPTION}
+      data-test-subj="add-exception-menu-item"
+      id="addException"
+      onClick={onClick}
+      disabled={disabled}
+    >
+      <EuiText data-test-subj="addExceptionButton" size="m">
+        {i18n.ACTION_ADD_EXCEPTION}
+      </EuiText>
+    </EuiContextMenuItem>
+  );
+};
+
+export const AddException = React.memo(AddExceptionComponent);
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
index b1881d29ec10d5..3a9a4e875369e7 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
@@ -6,53 +6,33 @@
  */
 
 import React, { useCallback, useMemo, useState } from 'react';
-import { useDispatch } from 'react-redux';
-import {
-  EuiButtonIcon,
-  EuiContextMenuItem,
-  EuiContextMenuPanel,
-  EuiPopover,
-  EuiText,
-  EuiToolTip,
-} from '@elastic/eui';
+
+import { EuiButtonIcon, EuiContextMenu, EuiPopover, EuiToolTip } from '@elastic/eui';
 import styled from 'styled-components';
-import { getOr } from 'lodash/fp';
 import { indexOf } from 'lodash';
 
-import type { ExceptionListType } from '@kbn/securitysolution-io-ts-list-types';
+import { ExceptionListType } from '@kbn/securitysolution-io-ts-list-types';
+import { get, getOr } from 'lodash/fp';
 import { buildGetAlertByIdQuery } from '../../../../common/components/exceptions/helpers';
-import { useAppToasts } from '../../../../common/hooks/use_app_toasts';
-import { TimelineId } from '../../../../../common/types/timeline';
-import {
-  DEFAULT_INDEX_PATTERN,
-  DEFAULT_INDEX_PATTERN_EXPERIMENTAL,
-} from '../../../../../common/constants';
-import { Status } from '../../../../../common/detection_engine/schemas/common/schemas';
-import { timelineActions } from '../../../../timelines/store/timeline';
 import { EventsTdContent } from '../../../../timelines/components/timeline/styles';
 import { DEFAULT_ICON_BUTTON_WIDTH } from '../../../../timelines/components/timeline/helpers';
-import { FILTER_OPEN, FILTER_CLOSED, FILTER_IN_PROGRESS } from '../alerts_filter_group';
-import { updateAlertStatusAction } from '../actions';
-import { SetEventsDeletedProps, SetEventsLoadingProps } from '../types';
 import { Ecs } from '../../../../../common/ecs';
 import {
   AddExceptionModal,
   AddExceptionModalProps,
 } from '../../../../common/components/exceptions/add_exception_modal';
-import * as i18nCommon from '../../../../common/translations';
 import * as i18n from '../translations';
-import {
-  useStateToaster,
-  displaySuccessToast,
-  displayErrorToast,
-} from '../../../../common/components/toasters';
 import { inputsModel } from '../../../../common/store';
-import { useUserData } from '../../user_info';
 import { AlertData, EcsHit } from '../../../../common/components/exceptions/types';
 import { useQueryAlerts } from '../../../containers/detection_engine/alerts/use_query';
 import { useSignalIndex } from '../../../containers/detection_engine/alerts/use_signal_index';
 import { EventFiltersModal } from '../../../../management/pages/event_filters/view/components/modal';
-import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features';
+import { useAlertsActions } from './use_alerts_actions';
+import { useExceptionModal } from './use_add_exception_modal';
+import { useExceptionActions } from './use_add_exception_actions';
+import { useEventFilterModal } from './use_event_filter_modal';
+import { useEventFilterAction } from './use_event_filter_action';
+import { Status } from '../../../../../common/detection_engine/schemas/common/schemas';
 
 interface AlertContextMenuProps {
   ariaLabel?: string;
@@ -71,56 +51,14 @@ const AlertContextMenuComponent: React.FC<AlertContextMenuProps> = ({
   onRuleChange,
   timelineId,
 }) => {
-  const dispatch = useDispatch();
-  const [, dispatchToaster] = useStateToaster();
   const [isPopoverOpen, setPopover] = useState(false);
-  const eventId = ecsRowData._id;
-  const ruleId = useMemo(
-    (): string | null =>
-      (ecsRowData.signal?.rule && ecsRowData.signal.rule.id && ecsRowData.signal.rule.id[0]) ??
-      null,
-    [ecsRowData]
-  );
-  const ruleName = useMemo(
-    (): string =>
-      (ecsRowData.signal?.rule && ecsRowData.signal.rule.name && ecsRowData.signal.rule.name[0]) ??
-      '',
-    [ecsRowData]
-  );
-
-  // TODO: Steph/ueba remove when past experimental
-  const uebaEnabled = useIsExperimentalFeatureEnabled('uebaEnabled');
-  const isEvent = useMemo(() => indexOf(ecsRowData.event?.kind, 'event') !== -1, [ecsRowData]);
-  const ruleIndices = useMemo((): string[] => {
-    if (
-      ecsRowData.signal?.rule &&
-      ecsRowData.signal.rule.index &&
-      ecsRowData.signal.rule.index.length > 0
-    ) {
-      return ecsRowData.signal.rule.index;
-    } else {
-      return uebaEnabled
-        ? [...DEFAULT_INDEX_PATTERN, ...DEFAULT_INDEX_PATTERN_EXPERIMENTAL]
-        : DEFAULT_INDEX_PATTERN;
-    }
-  }, [ecsRowData.signal?.rule, uebaEnabled]);
-
-  const { addWarning } = useAppToasts();
 
-  const alertStatus = useMemo(() => {
-    return ecsRowData.signal?.status && (ecsRowData.signal.status[0] as Status);
-  }, [ecsRowData]);
+  const ruleId = get(0, ecsRowData?.signal?.rule?.id);
+  const ruleName = get(0, ecsRowData?.signal?.rule?.name);
 
-  const onButtonClick = useCallback(() => {
-    setPopover(!isPopoverOpen);
-  }, [isPopoverOpen]);
+  const alertStatus = get(0, ecsRowData?.signal?.status) as Status;
 
-  const closePopover = useCallback((): void => {
-    setPopover(false);
-  }, []);
-  const [exceptionModalType, setOpenAddExceptionModal] = useState<ExceptionListType | null>(null);
-  const [isAddEventFilterModalOpen, setIsAddEventFilterModalOpen] = useState<boolean>(false);
-  const [{ canUserCRUD, hasIndexWrite, hasIndexMaintenance, hasIndexUpdateDelete }] = useUserData();
+  const isEvent = useMemo(() => indexOf(ecsRowData.event?.kind, 'event') !== -1, [ecsRowData]);
 
   const isEndpointAlert = useMemo((): boolean => {
     if (ecsRowData == null) {
@@ -133,188 +71,14 @@ const AlertContextMenuComponent: React.FC<AlertContextMenuProps> = ({
     return eventModules.includes('endpoint') && kinds.includes('alert');
   }, [ecsRowData]);
 
-  const closeAddExceptionModal = useCallback((): void => {
-    setOpenAddExceptionModal(null);
-  }, []);
+  const onButtonClick = useCallback(() => {
+    setPopover(!isPopoverOpen);
+  }, [isPopoverOpen]);
 
-  const closeAddEventFilterModal = useCallback((): void => {
-    setIsAddEventFilterModalOpen(false);
+  const closePopover = useCallback((): void => {
+    setPopover(false);
   }, []);
 
-  const onAddExceptionCancel = useCallback(() => {
-    closeAddExceptionModal();
-  }, [closeAddExceptionModal]);
-
-  const onAddExceptionConfirm = useCallback(
-    (didCloseAlert: boolean, didBulkCloseAlert) => {
-      closeAddExceptionModal();
-      if (timelineId !== TimelineId.active || didBulkCloseAlert) {
-        refetch();
-      }
-    },
-    [closeAddExceptionModal, timelineId, refetch]
-  );
-
-  const onAlertStatusUpdateSuccess = useCallback(
-    (updated: number, conflicts: number, newStatus: Status) => {
-      if (conflicts > 0) {
-        // Partial failure
-        addWarning({
-          title: i18nCommon.UPDATE_ALERT_STATUS_FAILED(conflicts),
-          text: i18nCommon.UPDATE_ALERT_STATUS_FAILED_DETAILED(updated, conflicts),
-        });
-      } else {
-        let title: string;
-        switch (newStatus) {
-          case 'closed':
-            title = i18n.CLOSED_ALERT_SUCCESS_TOAST(updated);
-            break;
-          case 'open':
-            title = i18n.OPENED_ALERT_SUCCESS_TOAST(updated);
-            break;
-          case 'in-progress':
-            title = i18n.IN_PROGRESS_ALERT_SUCCESS_TOAST(updated);
-        }
-        displaySuccessToast(title, dispatchToaster);
-      }
-    },
-    [dispatchToaster, addWarning]
-  );
-
-  const onAlertStatusUpdateFailure = useCallback(
-    (newStatus: Status, error: Error) => {
-      let title: string;
-      switch (newStatus) {
-        case 'closed':
-          title = i18n.CLOSED_ALERT_FAILED_TOAST;
-          break;
-        case 'open':
-          title = i18n.OPENED_ALERT_FAILED_TOAST;
-          break;
-        case 'in-progress':
-          title = i18n.IN_PROGRESS_ALERT_FAILED_TOAST;
-      }
-      displayErrorToast(title, [error.message], dispatchToaster);
-    },
-    [dispatchToaster]
-  );
-
-  const setEventsLoading = useCallback(
-    ({ eventIds, isLoading }: SetEventsLoadingProps) => {
-      dispatch(timelineActions.setEventsLoading({ id: timelineId, eventIds, isLoading }));
-    },
-    [dispatch, timelineId]
-  );
-
-  const setEventsDeleted = useCallback(
-    ({ eventIds, isDeleted }: SetEventsDeletedProps) => {
-      dispatch(timelineActions.setEventsDeleted({ id: timelineId, eventIds, isDeleted }));
-    },
-    [dispatch, timelineId]
-  );
-
-  const openAlertActionOnClick = useCallback(() => {
-    updateAlertStatusAction({
-      alertIds: [eventId],
-      onAlertStatusUpdateFailure,
-      onAlertStatusUpdateSuccess,
-      setEventsDeleted,
-      setEventsLoading,
-      selectedStatus: FILTER_OPEN,
-    });
-    closePopover();
-  }, [
-    closePopover,
-    eventId,
-    onAlertStatusUpdateFailure,
-    onAlertStatusUpdateSuccess,
-    setEventsDeleted,
-    setEventsLoading,
-  ]);
-
-  const openAlertActionComponent = useMemo(() => {
-    return (
-      <EuiContextMenuItem
-        key="open-alert"
-        aria-label="Open alert"
-        data-test-subj="open-alert-status"
-        id={FILTER_OPEN}
-        onClick={openAlertActionOnClick}
-        disabled={!hasIndexUpdateDelete && !hasIndexMaintenance}
-      >
-        <EuiText size="m">{i18n.ACTION_OPEN_ALERT}</EuiText>
-      </EuiContextMenuItem>
-    );
-  }, [openAlertActionOnClick, hasIndexUpdateDelete, hasIndexMaintenance]);
-
-  const closeAlertActionClick = useCallback(() => {
-    updateAlertStatusAction({
-      alertIds: [eventId],
-      onAlertStatusUpdateFailure,
-      onAlertStatusUpdateSuccess,
-      setEventsDeleted,
-      setEventsLoading,
-      selectedStatus: FILTER_CLOSED,
-    });
-    closePopover();
-  }, [
-    closePopover,
-    eventId,
-    onAlertStatusUpdateFailure,
-    onAlertStatusUpdateSuccess,
-    setEventsDeleted,
-    setEventsLoading,
-  ]);
-
-  const closeAlertActionComponent = useMemo(() => {
-    return (
-      <EuiContextMenuItem
-        key="close-alert"
-        aria-label="Close alert"
-        data-test-subj="close-alert-status"
-        id={FILTER_CLOSED}
-        onClick={closeAlertActionClick}
-        disabled={!hasIndexUpdateDelete && !hasIndexMaintenance}
-      >
-        <EuiText size="m">{i18n.ACTION_CLOSE_ALERT}</EuiText>
-      </EuiContextMenuItem>
-    );
-  }, [closeAlertActionClick, hasIndexUpdateDelete, hasIndexMaintenance]);
-
-  const inProgressAlertActionClick = useCallback(() => {
-    updateAlertStatusAction({
-      alertIds: [eventId],
-      onAlertStatusUpdateFailure,
-      onAlertStatusUpdateSuccess,
-      setEventsDeleted,
-      setEventsLoading,
-      selectedStatus: FILTER_IN_PROGRESS,
-    });
-    closePopover();
-  }, [
-    closePopover,
-    eventId,
-    onAlertStatusUpdateFailure,
-    onAlertStatusUpdateSuccess,
-    setEventsDeleted,
-    setEventsLoading,
-  ]);
-
-  const inProgressAlertActionComponent = useMemo(() => {
-    return (
-      <EuiContextMenuItem
-        key="in-progress-alert"
-        aria-label="Mark alert in progress"
-        data-test-subj="in-progress-alert-status"
-        id={FILTER_IN_PROGRESS}
-        onClick={inProgressAlertActionClick}
-        disabled={!canUserCRUD || !hasIndexUpdateDelete}
-      >
-        <EuiText size="m">{i18n.ACTION_IN_PROGRESS_ALERT}</EuiText>
-      </EuiContextMenuItem>
-    );
-  }, [canUserCRUD, hasIndexUpdateDelete, inProgressAlertActionClick]);
-
   const button = useMemo(() => {
     return (
       <EuiToolTip position="top" content={i18n.MORE_ACTIONS}>
@@ -330,105 +94,61 @@ const AlertContextMenuComponent: React.FC<AlertContextMenuProps> = ({
     );
   }, [disabled, onButtonClick, ariaLabel]);
 
-  const handleAddEndpointExceptionClick = useCallback((): void => {
-    closePopover();
-    setOpenAddExceptionModal('endpoint');
-  }, [closePopover]);
+  const {
+    exceptionModalType,
+    onAddExceptionCancel,
+    onAddExceptionConfirm,
+    onAddExceptionTypeClick,
+    ruleIndices,
+  } = useExceptionModal({
+    ruleIndex: ecsRowData?.signal?.rule?.index,
+    refetch,
+    timelineId,
+  });
 
-  const addEndpointExceptionComponent = useMemo(() => {
-    return (
-      <EuiContextMenuItem
-        key="add-endpoint-exception-menu-item"
-        aria-label="Add Endpoint Exception"
-        data-test-subj="add-endpoint-exception-menu-item"
-        id="addEndpointException"
-        onClick={handleAddEndpointExceptionClick}
-        disabled={!canUserCRUD || !hasIndexWrite || !isEndpointAlert}
-      >
-        <EuiText size="m">{i18n.ACTION_ADD_ENDPOINT_EXCEPTION}</EuiText>
-      </EuiContextMenuItem>
-    );
-  }, [canUserCRUD, hasIndexWrite, isEndpointAlert, handleAddEndpointExceptionClick]);
+  const {
+    closeAddEventFilterModal,
+    isAddEventFilterModalOpen,
+    onAddEventFilterClick,
+  } = useEventFilterModal();
 
-  const handleAddExceptionClick = useCallback((): void => {
-    closePopover();
-    setOpenAddExceptionModal('detection');
-  }, [closePopover]);
+  const { statusActions } = useAlertsActions({
+    alertStatus,
+    eventId: ecsRowData?._id,
+    timelineId,
+    closePopover,
+  });
 
-  const addExceptionComponent = useMemo(() => {
-    return (
-      <EuiContextMenuItem
-        key="add-exception-menu-item"
-        aria-label="Add Exception"
-        data-test-subj="add-exception-menu-item"
-        id="addException"
-        onClick={handleAddExceptionClick}
-        disabled={!canUserCRUD || !hasIndexWrite}
-      >
-        <EuiText data-test-subj="addExceptionButton" size="m">
-          {i18n.ACTION_ADD_EXCEPTION}
-        </EuiText>
-      </EuiContextMenuItem>
-    );
-  }, [handleAddExceptionClick, canUserCRUD, hasIndexWrite]);
+  const handleOnAddExceptionTypeClick = useCallback(
+    (type: ExceptionListType) => {
+      onAddExceptionTypeClick(type);
+      closePopover();
+    },
+    [closePopover, onAddExceptionTypeClick]
+  );
 
-  const handleAddEventFilterClick = useCallback((): void => {
+  const handleOnAddEventFilterClick = useCallback(() => {
+    onAddEventFilterClick();
     closePopover();
-    setIsAddEventFilterModalOpen(true);
-  }, [closePopover]);
-
-  const addEventFilterComponent = useMemo(
-    () => (
-      <EuiContextMenuItem
-        key="add-event-filter-menu-item"
-        aria-label="Add event filter"
-        data-test-subj="add-event-filter-menu-item"
-        id="addEventFilter"
-        onClick={handleAddEventFilterClick}
-      >
-        <EuiText data-test-subj="addEventFilterButton" size="m">
-          {i18n.ACTION_ADD_EVENT_FILTER}
-        </EuiText>
-      </EuiContextMenuItem>
-    ),
-    [handleAddEventFilterClick]
-  );
+  }, [closePopover, onAddEventFilterClick]);
 
-  const statusFilters = useMemo(() => {
-    if (!alertStatus) {
-      return [];
-    }
+  const exceptionActions = useExceptionActions({
+    isEndpointAlert,
+    onAddExceptionTypeClick: handleOnAddExceptionTypeClick,
+  });
 
-    switch (alertStatus) {
-      case 'open':
-        return [inProgressAlertActionComponent, closeAlertActionComponent];
-      case 'in-progress':
-        return [openAlertActionComponent, closeAlertActionComponent];
-      case 'closed':
-        return [openAlertActionComponent, inProgressAlertActionComponent];
-      default:
-        return [];
-    }
-  }, [
-    closeAlertActionComponent,
-    inProgressAlertActionComponent,
-    openAlertActionComponent,
-    alertStatus,
-  ]);
-
-  const items = useMemo(
-    () =>
-      !isEvent && ruleId
-        ? [...statusFilters, addEndpointExceptionComponent, addExceptionComponent]
-        : [addEventFilterComponent],
-    [
-      addEndpointExceptionComponent,
-      addExceptionComponent,
-      addEventFilterComponent,
-      statusFilters,
-      ruleId,
-      isEvent,
-    ]
+  const eventFilterActions = useEventFilterAction({
+    onAddEventFilterClick: handleOnAddEventFilterClick,
+  });
+
+  const panels = useMemo(
+    () => [
+      {
+        id: 0,
+        items: !isEvent && ruleId ? [...statusActions, ...exceptionActions] : [eventFilterActions],
+      },
+    ],
+    [eventFilterActions, exceptionActions, isEvent, ruleId, statusActions]
   );
 
   return (
@@ -444,23 +164,26 @@ const AlertContextMenuComponent: React.FC<AlertContextMenuProps> = ({
             anchorPosition="downLeft"
             repositionOnScroll
           >
-            <ContextMenuPanel items={items} />
+            <EuiContextMenu size="s" initialPanelId={0} panels={panels} />
           </EuiPopover>
         </EventsTdContent>
       </div>
-      {exceptionModalType != null && ruleId != null && ecsRowData != null && (
-        <AddExceptionModalWrapper
-          ruleName={ruleName}
-          ruleId={ruleId}
-          ruleIndices={ruleIndices}
-          exceptionListType={exceptionModalType}
-          ecsData={ecsRowData}
-          onCancel={onAddExceptionCancel}
-          onConfirm={onAddExceptionConfirm}
-          alertStatus={alertStatus}
-          onRuleChange={onRuleChange}
-        />
-      )}
+      {exceptionModalType != null &&
+        ruleId != null &&
+        ruleName != null &&
+        ecsRowData?._id != null && (
+          <AddExceptionModalWrapper
+            ruleName={ruleName}
+            ruleId={ruleId}
+            ruleIndices={ruleIndices}
+            exceptionListType={exceptionModalType}
+            eventId={ecsRowData?._id}
+            onCancel={onAddExceptionCancel}
+            onConfirm={onAddExceptionConfirm}
+            alertStatus={alertStatus}
+            onRuleChange={onRuleChange}
+          />
+        )}
       {isAddEventFilterModalOpen && ecsRowData != null && (
         <EventFiltersModal data={ecsRowData} onCancel={closeAddEventFilterModal} />
       )}
@@ -468,7 +191,7 @@ const AlertContextMenuComponent: React.FC<AlertContextMenuProps> = ({
   );
 };
 
-const ContextMenuPanel = styled(EuiContextMenuPanel)`
+const ContextMenuPanel = styled(EuiContextMenu)`
   font-size: ${({ theme }) => theme.eui.euiFontSizeS};
 `;
 
@@ -480,7 +203,7 @@ type AddExceptionModalWrapperProps = Omit<
   AddExceptionModalProps,
   'alertData' | 'isAlertDataLoading'
 > & {
-  ecsData: Ecs;
+  eventId?: string;
 };
 
 /**
@@ -488,12 +211,12 @@ type AddExceptionModalWrapperProps = Omit<
  * Due to the conditional nature of the modal and how we use the `ecsData` field,
  * we cannot use the fetch hook within the modal component itself
  */
-const AddExceptionModalWrapper: React.FC<AddExceptionModalWrapperProps> = ({
+export const AddExceptionModalWrapper: React.FC<AddExceptionModalWrapperProps> = ({
   ruleName,
   ruleId,
   ruleIndices,
   exceptionListType,
-  ecsData,
+  eventId,
   onCancel,
   onConfirm,
   alertStatus,
@@ -502,7 +225,7 @@ const AddExceptionModalWrapper: React.FC<AddExceptionModalWrapperProps> = ({
   const { loading: isSignalIndexLoading, signalIndexName } = useSignalIndex();
 
   const { loading: isLoadingAlertData, data } = useQueryAlerts<EcsHit, {}>({
-    query: buildGetAlertByIdQuery(ecsData?._id),
+    query: buildGetAlertByIdQuery(eventId),
     indexName: signalIndexName,
   });
 
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alerts_status_actions/close_status.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alerts_status_actions/close_status.tsx
new file mode 100644
index 00000000000000..038d58c38a0133
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alerts_status_actions/close_status.tsx
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiContextMenuItem, EuiText } from '@elastic/eui';
+import React from 'react';
+import { FILTER_CLOSED } from '../../alerts_filter_group';
+import * as i18n from '../../translations';
+
+interface CloseAlertActionProps {
+  onClick: () => void;
+  disabled?: boolean;
+}
+
+const CloseAlertActionComponent: React.FC<CloseAlertActionProps> = ({ onClick, disabled }) => {
+  return (
+    <EuiContextMenuItem
+      key="close-alert"
+      aria-label={i18n.ACTION_CLOSE_ALERT}
+      data-test-subj="close-alert-status"
+      id={FILTER_CLOSED}
+      onClick={onClick}
+      disabled={disabled}
+    >
+      <EuiText size="m">{i18n.ACTION_CLOSE_ALERT}</EuiText>
+    </EuiContextMenuItem>
+  );
+};
+
+export const CloseAlertAction = React.memo(CloseAlertActionComponent);
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alerts_status_actions/in_progress_alert_status.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alerts_status_actions/in_progress_alert_status.tsx
new file mode 100644
index 00000000000000..2bca5690328274
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alerts_status_actions/in_progress_alert_status.tsx
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiContextMenuItem, EuiText } from '@elastic/eui';
+import React from 'react';
+import { FILTER_IN_PROGRESS } from '../../alerts_filter_group';
+import * as i18n from '../../translations';
+
+interface InProgressAlertStatusProps {
+  onClick: () => void;
+  disabled?: boolean;
+}
+
+const InProgressAlertStatusComponent: React.FC<InProgressAlertStatusProps> = ({
+  onClick,
+  disabled,
+}) => {
+  return (
+    <EuiContextMenuItem
+      key="in-progress-alert"
+      aria-label={i18n.ACTION_IN_PROGRESS_ALERT}
+      data-test-subj="in-progress-alert-status"
+      id={FILTER_IN_PROGRESS}
+      onClick={onClick}
+      disabled={disabled}
+    >
+      <EuiText size="m">{i18n.ACTION_IN_PROGRESS_ALERT}</EuiText>
+    </EuiContextMenuItem>
+  );
+};
+
+export const InProgressAlertStatus = React.memo(InProgressAlertStatusComponent);
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alerts_status_actions/open_alert_status.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alerts_status_actions/open_alert_status.tsx
new file mode 100644
index 00000000000000..34832ee07ea759
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alerts_status_actions/open_alert_status.tsx
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiContextMenuItem, EuiText } from '@elastic/eui';
+import React from 'react';
+import { FILTER_OPEN } from '../../alerts_filter_group';
+import * as i18n from '../../translations';
+
+interface OpenAlertStatusProps {
+  onClick: () => void;
+  disabled?: boolean;
+}
+
+const OpenAlertStatusComponent: React.FC<OpenAlertStatusProps> = ({ onClick, disabled }) => {
+  return (
+    <EuiContextMenuItem
+      key="open-alert"
+      aria-label={i18n.ACTION_OPEN_ALERT}
+      data-test-subj="open-alert-status"
+      id={FILTER_OPEN}
+      onClick={onClick}
+      disabled={disabled}
+    >
+      <EuiText size="m">{i18n.ACTION_OPEN_ALERT}</EuiText>
+    </EuiContextMenuItem>
+  );
+};
+
+export const OpenAlertStatus = React.memo(OpenAlertStatusComponent);
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.tsx
index 3bf30d57d4a8a5..04cba8332553ab 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.tsx
@@ -5,102 +5,41 @@
  * 2.0.
  */
 
-import React, { useCallback } from 'react';
-import { useDispatch } from 'react-redux';
+import React from 'react';
 
-import { useKibana } from '../../../../common/lib/kibana';
-import { TimelineId } from '../../../../../common/types/timeline';
 import { Ecs } from '../../../../../common/ecs';
 import { TimelineNonEcsData } from '../../../../../common/search_strategy/timeline';
-import { timelineActions } from '../../../../timelines/store/timeline';
-import { sendAlertToTimelineAction } from '../actions';
-import { dispatchUpdateTimeline } from '../../../../timelines/components/open_timeline/helpers';
 import { ActionIconItem } from '../../../../timelines/components/timeline/body/actions/action_icon_item';
-import { CreateTimelineProps } from '../types';
+
 import {
   ACTION_INVESTIGATE_IN_TIMELINE,
   ACTION_INVESTIGATE_IN_TIMELINE_ARIA_LABEL,
 } from '../translations';
+import { useInvestigateInTimeline } from './use_investigate_in_timeline';
 
 interface InvestigateInTimelineActionProps {
-  ecsRowData: Ecs | Ecs[] | null;
-  nonEcsRowData: TimelineNonEcsData[];
+  ecsRowData?: Ecs | Ecs[] | null;
+  nonEcsRowData?: TimelineNonEcsData[];
   ariaLabel?: string;
   alertIds?: string[];
-  fetchEcsAlertsData?: (alertIds?: string[]) => Promise<Ecs[]>;
+  buttonType?: 'text' | 'icon';
+  onInvestigateInTimelineAlertClick?: () => void;
 }
 
 const InvestigateInTimelineActionComponent: React.FC<InvestigateInTimelineActionProps> = ({
   ariaLabel = ACTION_INVESTIGATE_IN_TIMELINE_ARIA_LABEL,
   alertIds,
   ecsRowData,
-  fetchEcsAlertsData,
   nonEcsRowData,
+  buttonType,
+  onInvestigateInTimelineAlertClick,
 }) => {
-  const {
-    data: { search: searchStrategyClient },
-  } = useKibana().services;
-  const dispatch = useDispatch();
-
-  const updateTimelineIsLoading = useCallback(
-    (payload) => dispatch(timelineActions.updateIsLoading(payload)),
-    [dispatch]
-  );
-
-  const createTimeline = useCallback(
-    ({ from: fromTimeline, timeline, to: toTimeline, ruleNote }: CreateTimelineProps) => {
-      updateTimelineIsLoading({ id: TimelineId.active, isLoading: false });
-      dispatchUpdateTimeline(dispatch)({
-        duplicate: true,
-        from: fromTimeline,
-        id: TimelineId.active,
-        notes: [],
-        timeline: {
-          ...timeline,
-          // by setting as an empty array, it will default to all in the reducer because of the event type
-          indexNames: [],
-          show: true,
-        },
-        to: toTimeline,
-        ruleNote,
-      })();
-    },
-    [dispatch, updateTimelineIsLoading]
-  );
-
-  const investigateInTimelineAlertClick = useCallback(async () => {
-    try {
-      if (ecsRowData != null) {
-        await sendAlertToTimelineAction({
-          createTimeline,
-          ecsData: ecsRowData,
-          nonEcsData: nonEcsRowData,
-          searchStrategyClient,
-          updateTimelineIsLoading,
-        });
-      }
-      if (ecsRowData == null && fetchEcsAlertsData) {
-        const alertsEcsData = await fetchEcsAlertsData(alertIds);
-        await sendAlertToTimelineAction({
-          createTimeline,
-          ecsData: alertsEcsData,
-          nonEcsData: nonEcsRowData,
-          searchStrategyClient,
-          updateTimelineIsLoading,
-        });
-      }
-    } catch {
-      // TODO show a toaster that something went wrong
-    }
-  }, [
-    alertIds,
-    createTimeline,
+  const { investigateInTimelineAlertClick } = useInvestigateInTimeline({
     ecsRowData,
-    fetchEcsAlertsData,
     nonEcsRowData,
-    searchStrategyClient,
-    updateTimelineIsLoading,
-  ]);
+    alertIds,
+    onInvestigateInTimelineAlertClick,
+  });
 
   return (
     <ActionIconItem
@@ -110,6 +49,7 @@ const InvestigateInTimelineActionComponent: React.FC<InvestigateInTimelineAction
       iconType="timeline"
       onClick={investigateInTimelineAlertClick}
       isDisabled={false}
+      buttonType={buttonType}
     />
   );
 };
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_add_exception_actions.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_add_exception_actions.tsx
new file mode 100644
index 00000000000000..0f8fa00a3ac40c
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_add_exception_actions.tsx
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useCallback, useMemo } from 'react';
+import type { ExceptionListType } from '@kbn/securitysolution-io-ts-list-types';
+
+import { useUserData } from '../../user_info';
+import { ACTION_ADD_ENDPOINT_EXCEPTION, ACTION_ADD_EXCEPTION } from '../translations';
+
+interface UseExceptionActions {
+  name: string;
+  onClick: () => void;
+  disabled: boolean;
+}
+
+interface UseExceptionActionProps {
+  isEndpointAlert: boolean;
+  onAddExceptionTypeClick: (type: ExceptionListType) => void;
+}
+
+export const useExceptionActions = ({
+  isEndpointAlert,
+  onAddExceptionTypeClick,
+}: UseExceptionActionProps): UseExceptionActions[] => {
+  const [{ canUserCRUD, hasIndexWrite }] = useUserData();
+
+  const handleDetectionExceptionModal = useCallback(() => {
+    onAddExceptionTypeClick('detection');
+  }, [onAddExceptionTypeClick]);
+
+  const handleEndpointExceptionModal = useCallback(() => {
+    onAddExceptionTypeClick('endpoint');
+  }, [onAddExceptionTypeClick]);
+
+  const disabledAddEndpointException = !canUserCRUD || !hasIndexWrite || !isEndpointAlert;
+  const disabledAddException = !canUserCRUD || !hasIndexWrite;
+
+  const exceptionActions = useMemo(
+    () => [
+      {
+        name: ACTION_ADD_ENDPOINT_EXCEPTION,
+        onClick: handleEndpointExceptionModal,
+        disabled: disabledAddEndpointException,
+        [`data-test-subj`]: 'add-endpoint-exception-menu-item',
+      },
+      {
+        name: ACTION_ADD_EXCEPTION,
+        onClick: handleDetectionExceptionModal,
+        disabled: disabledAddException,
+        [`data-test-subj`]: 'add-exception-menu-item',
+      },
+    ],
+    [
+      disabledAddEndpointException,
+      disabledAddException,
+      handleDetectionExceptionModal,
+      handleEndpointExceptionModal,
+    ]
+  );
+
+  return exceptionActions;
+};
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_add_exception_modal.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_add_exception_modal.tsx
new file mode 100644
index 00000000000000..e6234382134332
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_add_exception_modal.tsx
@@ -0,0 +1,77 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useCallback, useMemo, useState } from 'react';
+import type { ExceptionListType } from '@kbn/securitysolution-io-ts-list-types';
+
+import {
+  DEFAULT_INDEX_PATTERN,
+  DEFAULT_INDEX_PATTERN_EXPERIMENTAL,
+} from '../../../../../common/constants';
+import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features';
+import { TimelineId } from '../../../../../common/types/timeline';
+import { inputsModel } from '../../../../common/store';
+
+interface UseExceptionModalProps {
+  ruleIndex: string[] | null | undefined;
+  refetch?: inputsModel.Refetch;
+  timelineId: string;
+}
+interface UseExceptionModal {
+  exceptionModalType: ExceptionListType | null;
+  onAddExceptionTypeClick: (type: ExceptionListType) => void;
+  onAddExceptionCancel: () => void;
+  onAddExceptionConfirm: (didCloseAlert: boolean, didBulkCloseAlert: boolean) => void;
+  ruleIndices: string[];
+}
+
+export const useExceptionModal = ({
+  ruleIndex,
+  refetch,
+  timelineId,
+}: UseExceptionModalProps): UseExceptionModal => {
+  const [exceptionModalType, setOpenAddExceptionModal] = useState<ExceptionListType | null>(null);
+
+  // TODO: Steph/ueba remove when past experimental
+  const uebaEnabled = useIsExperimentalFeatureEnabled('uebaEnabled');
+
+  const ruleIndices = useMemo((): string[] => {
+    if (ruleIndex != null) {
+      return ruleIndex;
+    } else {
+      return uebaEnabled
+        ? [...DEFAULT_INDEX_PATTERN, ...DEFAULT_INDEX_PATTERN_EXPERIMENTAL]
+        : DEFAULT_INDEX_PATTERN;
+    }
+  }, [ruleIndex, uebaEnabled]);
+
+  const onAddExceptionTypeClick = useCallback((exceptionListType: ExceptionListType): void => {
+    setOpenAddExceptionModal(exceptionListType);
+  }, []);
+
+  const onAddExceptionCancel = useCallback(() => {
+    setOpenAddExceptionModal(null);
+  }, []);
+
+  const onAddExceptionConfirm = useCallback(
+    (didCloseAlert: boolean, didBulkCloseAlert) => {
+      if (refetch && (timelineId !== TimelineId.active || didBulkCloseAlert)) {
+        refetch();
+      }
+      setOpenAddExceptionModal(null);
+    },
+    [refetch, timelineId]
+  );
+
+  return {
+    exceptionModalType,
+    onAddExceptionTypeClick,
+    onAddExceptionCancel,
+    onAddExceptionConfirm,
+    ruleIndices,
+  };
+};
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_alerts_actions.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_alerts_actions.tsx
new file mode 100644
index 00000000000000..855eb2dd5fef4f
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_alerts_actions.tsx
@@ -0,0 +1,217 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useCallback, useMemo } from 'react';
+import { useDispatch } from 'react-redux';
+
+import { useAppToasts } from '../../../../common/hooks/use_app_toasts';
+import { Status } from '../../../../../common/detection_engine/schemas/common/schemas';
+import { timelineActions } from '../../../../timelines/store/timeline';
+import { FILTER_OPEN, FILTER_CLOSED, FILTER_IN_PROGRESS } from '../alerts_filter_group';
+import { updateAlertStatusAction } from '../actions';
+import { SetEventsDeletedProps, SetEventsLoadingProps } from '../types';
+import * as i18nCommon from '../../../../common/translations';
+import * as i18n from '../translations';
+
+import {
+  useStateToaster,
+  displaySuccessToast,
+  displayErrorToast,
+} from '../../../../common/components/toasters';
+import { useUserData } from '../../user_info';
+
+interface Props {
+  alertStatus?: string;
+  closePopover: () => void;
+  eventId: string | null | undefined;
+  timelineId: string;
+}
+
+export const useAlertsActions = ({ alertStatus, closePopover, eventId, timelineId }: Props) => {
+  const dispatch = useDispatch();
+  const [, dispatchToaster] = useStateToaster();
+
+  const { addWarning } = useAppToasts();
+
+  const [{ canUserCRUD, hasIndexMaintenance, hasIndexUpdateDelete }] = useUserData();
+
+  const onAlertStatusUpdateSuccess = useCallback(
+    (updated: number, conflicts: number, newStatus: Status) => {
+      if (conflicts > 0) {
+        // Partial failure
+        addWarning({
+          title: i18nCommon.UPDATE_ALERT_STATUS_FAILED(conflicts),
+          text: i18nCommon.UPDATE_ALERT_STATUS_FAILED_DETAILED(updated, conflicts),
+        });
+      } else {
+        let title: string;
+        switch (newStatus) {
+          case 'closed':
+            title = i18n.CLOSED_ALERT_SUCCESS_TOAST(updated);
+            break;
+          case 'open':
+            title = i18n.OPENED_ALERT_SUCCESS_TOAST(updated);
+            break;
+          case 'in-progress':
+            title = i18n.IN_PROGRESS_ALERT_SUCCESS_TOAST(updated);
+        }
+
+        displaySuccessToast(title, dispatchToaster);
+      }
+    },
+    [addWarning, dispatchToaster]
+  );
+
+  const onAlertStatusUpdateFailure = useCallback(
+    (newStatus: Status, error: Error) => {
+      let title: string;
+      switch (newStatus) {
+        case 'closed':
+          title = i18n.CLOSED_ALERT_FAILED_TOAST;
+          break;
+        case 'open':
+          title = i18n.OPENED_ALERT_FAILED_TOAST;
+          break;
+        case 'in-progress':
+          title = i18n.IN_PROGRESS_ALERT_FAILED_TOAST;
+      }
+      displayErrorToast(title, [error.message], dispatchToaster);
+    },
+    [dispatchToaster]
+  );
+
+  const setEventsLoading = useCallback(
+    ({ eventIds, isLoading }: SetEventsLoadingProps) => {
+      dispatch(timelineActions.setEventsLoading({ id: timelineId, eventIds, isLoading }));
+    },
+    [dispatch, timelineId]
+  );
+
+  const setEventsDeleted = useCallback(
+    ({ eventIds, isDeleted }: SetEventsDeletedProps) => {
+      dispatch(timelineActions.setEventsDeleted({ id: timelineId, eventIds, isDeleted }));
+    },
+    [dispatch, timelineId]
+  );
+
+  const openAlertActionOnClick = useCallback(() => {
+    if (eventId) {
+      updateAlertStatusAction({
+        alertIds: [eventId],
+        onAlertStatusUpdateFailure,
+        onAlertStatusUpdateSuccess,
+        setEventsDeleted,
+        setEventsLoading,
+        selectedStatus: FILTER_OPEN,
+      });
+    }
+    closePopover();
+  }, [
+    closePopover,
+    eventId,
+    onAlertStatusUpdateFailure,
+    onAlertStatusUpdateSuccess,
+    setEventsDeleted,
+    setEventsLoading,
+  ]);
+
+  const closeAlertActionClick = useCallback(() => {
+    if (eventId) {
+      updateAlertStatusAction({
+        alertIds: [eventId],
+        onAlertStatusUpdateFailure,
+        onAlertStatusUpdateSuccess,
+        setEventsDeleted,
+        setEventsLoading,
+        selectedStatus: FILTER_CLOSED,
+      });
+    }
+
+    closePopover();
+  }, [
+    closePopover,
+    eventId,
+    onAlertStatusUpdateFailure,
+    onAlertStatusUpdateSuccess,
+    setEventsDeleted,
+    setEventsLoading,
+  ]);
+
+  const inProgressAlertActionClick = useCallback(() => {
+    if (eventId) {
+      updateAlertStatusAction({
+        alertIds: [eventId],
+        onAlertStatusUpdateFailure,
+        onAlertStatusUpdateSuccess,
+        setEventsDeleted,
+        setEventsLoading,
+        selectedStatus: FILTER_IN_PROGRESS,
+      });
+    }
+
+    closePopover();
+  }, [
+    closePopover,
+    eventId,
+    onAlertStatusUpdateFailure,
+    onAlertStatusUpdateSuccess,
+    setEventsDeleted,
+    setEventsLoading,
+  ]);
+
+  const disabledInProgressAlertAction = !canUserCRUD || !hasIndexUpdateDelete;
+
+  const inProgressAlertAction = useMemo(() => {
+    return {
+      name: i18n.ACTION_IN_PROGRESS_ALERT,
+      disabled: disabledInProgressAlertAction,
+      onClick: inProgressAlertActionClick,
+      [`data-test-subj`]: 'in-progress-alert-status',
+    };
+  }, [disabledInProgressAlertAction, inProgressAlertActionClick]);
+
+  const disabledCloseAlertAction = !hasIndexUpdateDelete && !hasIndexMaintenance;
+  const closeAlertAction = useMemo(() => {
+    return {
+      name: i18n.ACTION_CLOSE_ALERT,
+      disabled: disabledCloseAlertAction,
+      onClick: closeAlertActionClick,
+      [`data-test-subj`]: 'close-alert-status',
+    };
+  }, [disabledCloseAlertAction, closeAlertActionClick]);
+
+  const disabledOpenAlertAction = !hasIndexUpdateDelete && !hasIndexMaintenance;
+  const openAlertAction = useMemo(() => {
+    return {
+      name: i18n.ACTION_OPEN_ALERT,
+      disabled: disabledOpenAlertAction,
+      onClick: openAlertActionOnClick,
+      [`data-test-subj`]: 'open-alert-status',
+    };
+  }, [disabledOpenAlertAction, openAlertActionOnClick]);
+
+  const statusActions = useMemo(() => {
+    if (!alertStatus) {
+      return [];
+    }
+
+    switch (alertStatus) {
+      case 'open':
+        return [inProgressAlertAction, closeAlertAction];
+      case 'in-progress':
+        return [openAlertAction, closeAlertAction];
+      case 'closed':
+        return [openAlertAction, inProgressAlertAction];
+      default:
+        return [];
+    }
+  }, [alertStatus, inProgressAlertAction, closeAlertAction, openAlertAction]);
+
+  return {
+    statusActions,
+  };
+};
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_event_filter_action.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_event_filter_action.tsx
new file mode 100644
index 00000000000000..c24a1e0223ede4
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_event_filter_action.tsx
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useMemo } from 'react';
+import { ACTION_ADD_EVENT_FILTER } from '../translations';
+
+export const useEventFilterAction = ({
+  onAddEventFilterClick,
+}: {
+  onAddEventFilterClick: () => void;
+}) => {
+  const eventFilterActions = useMemo(
+    () => ({
+      name: ACTION_ADD_EVENT_FILTER,
+      onClick: onAddEventFilterClick,
+    }),
+    [onAddEventFilterClick]
+  );
+  return eventFilterActions;
+};
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_event_filter_modal.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_event_filter_modal.tsx
new file mode 100644
index 00000000000000..88917a6428cc82
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_event_filter_modal.tsx
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useCallback, useState } from 'react';
+
+export const useEventFilterModal = () => {
+  const [isAddEventFilterModalOpen, setIsAddEventFilterModalOpen] = useState<boolean>(false);
+
+  const onAddEventFilterClick = useCallback((): void => {
+    setIsAddEventFilterModalOpen(true);
+  }, []);
+  const closeAddEventFilterModal = useCallback((): void => {
+    setIsAddEventFilterModalOpen(false);
+  }, []);
+
+  return { closeAddEventFilterModal, isAddEventFilterModalOpen, onAddEventFilterClick };
+};
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_investigate_in_timeline.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_investigate_in_timeline.tsx
new file mode 100644
index 00000000000000..0671101f47a378
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_investigate_in_timeline.tsx
@@ -0,0 +1,120 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { useCallback } from 'react';
+import { useDispatch } from 'react-redux';
+
+import { useKibana } from '../../../../common/lib/kibana';
+
+import { TimelineId } from '../../../../../common/types/timeline';
+import { Ecs } from '../../../../../common/ecs';
+import { TimelineNonEcsData } from '../../../../../common/search_strategy/timeline';
+import { timelineActions } from '../../../../timelines/store/timeline';
+import { sendAlertToTimelineAction } from '../actions';
+import { dispatchUpdateTimeline } from '../../../../timelines/components/open_timeline/helpers';
+import { CreateTimelineProps } from '../types';
+import { ACTION_INVESTIGATE_IN_TIMELINE } from '../translations';
+import { useFetchEcsAlertsData } from '../../../containers/detection_engine/alerts/use_fetch_ecs_alerts_data';
+
+interface UseInvestigateInTimelineActionProps {
+  ecsRowData?: Ecs | Ecs[] | null;
+  nonEcsRowData?: TimelineNonEcsData[];
+  alertIds?: string[] | null | undefined;
+  onInvestigateInTimelineAlertClick?: () => void;
+}
+
+export const useInvestigateInTimeline = ({
+  ecsRowData,
+  nonEcsRowData,
+  alertIds,
+  onInvestigateInTimelineAlertClick,
+}: UseInvestigateInTimelineActionProps) => {
+  const {
+    data: { search: searchStrategyClient },
+  } = useKibana().services;
+  const dispatch = useDispatch();
+
+  const updateTimelineIsLoading = useCallback(
+    (payload) => dispatch(timelineActions.updateIsLoading(payload)),
+    [dispatch]
+  );
+
+  const createTimeline = useCallback(
+    ({ from: fromTimeline, timeline, to: toTimeline, ruleNote }: CreateTimelineProps) => {
+      updateTimelineIsLoading({ id: TimelineId.active, isLoading: false });
+      dispatchUpdateTimeline(dispatch)({
+        duplicate: true,
+        from: fromTimeline,
+        id: TimelineId.active,
+        notes: [],
+        timeline: {
+          ...timeline,
+          // by setting as an empty array, it will default to all in the reducer because of the event type
+          indexNames: [],
+          show: true,
+        },
+        to: toTimeline,
+        ruleNote,
+      })();
+    },
+    [dispatch, updateTimelineIsLoading]
+  );
+
+  const showInvestigateInTimelineAction = alertIds != null;
+  const { isLoading: isFetchingAlertEcs, alertsEcsData } = useFetchEcsAlertsData({
+    alertIds,
+    skip: ecsRowData != null || alertIds == null,
+  });
+
+  const investigateInTimelineAlertClick = useCallback(async () => {
+    if (onInvestigateInTimelineAlertClick) {
+      onInvestigateInTimelineAlertClick();
+    }
+    if (alertsEcsData != null) {
+      await sendAlertToTimelineAction({
+        createTimeline,
+        ecsData: alertsEcsData,
+        nonEcsData: nonEcsRowData ?? [],
+        searchStrategyClient,
+        updateTimelineIsLoading,
+      });
+    }
+
+    if (ecsRowData != null) {
+      await sendAlertToTimelineAction({
+        createTimeline,
+        ecsData: ecsRowData,
+        nonEcsData: nonEcsRowData ?? [],
+        searchStrategyClient,
+        updateTimelineIsLoading,
+      });
+    }
+  }, [
+    alertsEcsData,
+    createTimeline,
+    ecsRowData,
+    nonEcsRowData,
+    onInvestigateInTimelineAlertClick,
+    searchStrategyClient,
+    updateTimelineIsLoading,
+  ]);
+
+  const investigateInTimelineAction = showInvestigateInTimelineAction
+    ? [
+        {
+          name: ACTION_INVESTIGATE_IN_TIMELINE,
+          onClick: investigateInTimelineAlertClick,
+          disabled: isFetchingAlertEcs,
+        },
+      ]
+    : [];
+
+  return {
+    investigateInTimelineAction,
+    investigateInTimelineAlertClick,
+    showInvestigateInTimelineAction,
+  };
+};
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/translations.ts b/x-pack/plugins/security_solution/public/detections/components/alerts_table/translations.ts
index c63b4b73ae3152..badc077244acd3 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/translations.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/translations.ts
@@ -178,6 +178,13 @@ export const ACTION_ADD_EVENT_FILTER = i18n.translate(
   }
 );
 
+export const ACTION_ADD_TO_CASE = i18n.translate(
+  'xpack.securitySolution.detectionEngine.alerts.actions.addToCase',
+  {
+    defaultMessage: 'Add to case',
+  }
+);
+
 export const ACTION_ADD_ENDPOINT_EXCEPTION = i18n.translate(
   'xpack.securitySolution.detectionEngine.alerts.actions.addEndpointException',
   {
diff --git a/x-pack/plugins/security_solution/public/detections/components/host_isolation/helpers.ts b/x-pack/plugins/security_solution/public/detections/components/host_isolation/helpers.ts
new file mode 100644
index 00000000000000..aa08db0a236699
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/host_isolation/helpers.ts
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { find } from 'lodash/fp';
+
+import type { TimelineEventsDetailsItem } from '../../../../common';
+
+export const getFieldValue = (
+  {
+    category,
+    field,
+  }: {
+    category: string;
+    field: string;
+  },
+  data: TimelineEventsDetailsItem[] | null
+) => {
+  const currentField = find({ category, field }, data)?.values;
+  return currentField && currentField.length > 0 ? currentField[0] : '';
+};
diff --git a/x-pack/plugins/security_solution/public/detections/components/host_isolation/take_action_dropdown.tsx b/x-pack/plugins/security_solution/public/detections/components/host_isolation/take_action_dropdown.tsx
deleted file mode 100644
index 1404f7927d6ec8..00000000000000
--- a/x-pack/plugins/security_solution/public/detections/components/host_isolation/take_action_dropdown.tsx
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { useState, useCallback, useMemo } from 'react';
-import { EuiContextMenuItem, EuiContextMenuPanel, EuiButton, EuiPopover } from '@elastic/eui';
-import { ISOLATE_HOST, UNISOLATE_HOST } from './translations';
-import { TAKE_ACTION } from '../alerts_table/alerts_utility_bar/translations';
-import { useHostIsolationStatus } from '../../containers/detection_engine/alerts/use_host_isolation_status';
-import { HostStatus } from '../../../../common/endpoint/types';
-
-export const TakeActionDropdown = React.memo(
-  ({
-    onChange,
-    agentId,
-  }: {
-    onChange: (action: 'isolateHost' | 'unisolateHost') => void;
-    agentId: string;
-  }) => {
-    const { loading, isIsolated: isolationStatus, agentStatus } = useHostIsolationStatus({
-      agentId,
-    });
-    const [isPopoverOpen, setIsPopoverOpen] = useState(false);
-
-    const closePopoverHandler = useCallback(() => {
-      setIsPopoverOpen(false);
-    }, []);
-
-    const isolateHostHandler = useCallback(() => {
-      setIsPopoverOpen(false);
-      if (isolationStatus === false) {
-        onChange('isolateHost');
-      } else {
-        onChange('unisolateHost');
-      }
-    }, [onChange, isolationStatus]);
-
-    const takeActionButton = useMemo(() => {
-      return (
-        <EuiButton
-          iconSide="right"
-          fill
-          iconType="arrowDown"
-          disabled={loading || agentStatus === HostStatus.UNENROLLED}
-          onClick={() => {
-            setIsPopoverOpen(!isPopoverOpen);
-          }}
-        >
-          {TAKE_ACTION}
-        </EuiButton>
-      );
-    }, [isPopoverOpen, loading, agentStatus]);
-
-    return (
-      <EuiPopover
-        id="hostIsolationTakeActionPanel"
-        button={takeActionButton}
-        isOpen={isPopoverOpen}
-        closePopover={closePopoverHandler}
-        panelPaddingSize="none"
-        anchorPosition="downLeft"
-      >
-        <EuiContextMenuPanel size="s">
-          {isolationStatus === false ? (
-            <EuiContextMenuItem key="isolateHost" onClick={isolateHostHandler}>
-              {ISOLATE_HOST}
-            </EuiContextMenuItem>
-          ) : (
-            <EuiContextMenuItem key="unisolateHost" onClick={isolateHostHandler}>
-              {UNISOLATE_HOST}
-            </EuiContextMenuItem>
-          )}
-        </EuiContextMenuPanel>
-      </EuiPopover>
-    );
-  }
-);
-
-TakeActionDropdown.displayName = 'TakeActionDropdown';
diff --git a/x-pack/plugins/security_solution/public/detections/components/host_isolation/use_host_isolation_action.tsx b/x-pack/plugins/security_solution/public/detections/components/host_isolation/use_host_isolation_action.tsx
new file mode 100644
index 00000000000000..d7e54e7f9900bd
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/host_isolation/use_host_isolation_action.tsx
@@ -0,0 +1,101 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { useCallback, useMemo } from 'react';
+import type { TimelineEventsDetailsItem } from '../../../../common';
+import { isIsolationSupported } from '../../../../common/endpoint/service/host_isolation/utils';
+import { HostStatus } from '../../../../common/endpoint/types';
+import { useIsolationPrivileges } from '../../../common/hooks/endpoint/use_isolate_privileges';
+import { endpointAlertCheck } from '../../../common/utils/endpoint_alert_check';
+import { useHostIsolationStatus } from '../../containers/detection_engine/alerts/use_host_isolation_status';
+import { ISOLATE_HOST, UNISOLATE_HOST } from './translations';
+import { getFieldValue } from './helpers';
+
+interface UseHostIsolationActionProps {
+  closePopover: () => void;
+  detailsData: TimelineEventsDetailsItem[] | null;
+  isHostIsolationPanelOpen: boolean;
+  onAddIsolationStatusClick: (action: 'isolateHost' | 'unisolateHost') => void;
+}
+
+export const useHostIsolationAction = ({
+  closePopover,
+  detailsData,
+  isHostIsolationPanelOpen,
+  onAddIsolationStatusClick,
+}: UseHostIsolationActionProps) => {
+  const isEndpointAlert = useMemo(() => {
+    return endpointAlertCheck({ data: detailsData || [] });
+  }, [detailsData]);
+
+  const agentId = useMemo(
+    () => getFieldValue({ category: 'agent', field: 'agent.id' }, detailsData),
+    [detailsData]
+  );
+
+  const hostOsFamily = useMemo(
+    () => getFieldValue({ category: 'host', field: 'host.os.name' }, detailsData),
+    [detailsData]
+  );
+
+  const agentVersion = useMemo(
+    () => getFieldValue({ category: 'agent', field: 'agent.version' }, detailsData),
+    [detailsData]
+  );
+
+  const isolationSupported = isIsolationSupported({
+    osName: hostOsFamily,
+    version: agentVersion,
+  });
+
+  const {
+    loading: loadingHostIsolationStatus,
+    isIsolated: isolationStatus,
+    agentStatus,
+  } = useHostIsolationStatus({
+    agentId,
+  });
+
+  const { isAllowed: isIsolationAllowed } = useIsolationPrivileges();
+
+  const isolateHostHandler = useCallback(() => {
+    closePopover();
+    if (isolationStatus === false) {
+      onAddIsolationStatusClick('isolateHost');
+    } else {
+      onAddIsolationStatusClick('unisolateHost');
+    }
+  }, [closePopover, isolationStatus, onAddIsolationStatusClick]);
+
+  const isolateHostTitle = isolationStatus === false ? ISOLATE_HOST : UNISOLATE_HOST;
+
+  const hostIsolationAction = useMemo(
+    () =>
+      isIsolationAllowed &&
+      isEndpointAlert &&
+      isolationSupported &&
+      isHostIsolationPanelOpen === false
+        ? [
+            {
+              name: isolateHostTitle,
+              onClick: isolateHostHandler,
+              disabled: loadingHostIsolationStatus || agentStatus === HostStatus.UNENROLLED,
+            },
+          ]
+        : [],
+    [
+      agentStatus,
+      isEndpointAlert,
+      isHostIsolationPanelOpen,
+      isIsolationAllowed,
+      isolateHostHandler,
+      isolateHostTitle,
+      isolationSupported,
+      loadingHostIsolationStatus,
+    ]
+  );
+  return hostIsolationAction;
+};
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.test.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.test.tsx
index 935a5ff336c00f..70b98eb22fd89a 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.test.tsx
@@ -20,6 +20,9 @@ describe('UpdatePrePackagedRulesCallOut', () => {
         docLinks: {
           ELASTIC_WEBSITE_URL: '',
           DOC_LINK_VERSION: '',
+          links: {
+            siem: { ruleChangeLog: '' },
+          },
         },
       },
     });
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.tsx
index 754acea40ed9bd..9d67a1e6b9ae86 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.tsx
@@ -56,10 +56,7 @@ const UpdatePrePackagedRulesCallOutComponent: React.FC<UpdatePrePackagedRulesCal
       <p>
         {prepackagedRulesOrTimelines?.callOutMessage}
         <br />
-        <EuiLink
-          href={`${services.docLinks.ELASTIC_WEBSITE_URL}guide/en/security/${services.docLinks.DOC_LINK_VERSION}/prebuilt-rules-changelog.html`}
-          target="_blank"
-        >
+        <EuiLink href={`${services.docLinks.links.siem.ruleChangeLog}`} target="_blank">
           {i18n.RELEASE_NOTES_HELP}
         </EuiLink>
       </p>
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule_details/index.test.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule_details/index.test.tsx
index 5061f12c0d22fd..d2003c411f05cc 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule_details/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule_details/index.test.tsx
@@ -160,7 +160,7 @@ describe('StepAboutRuleToggleDetails', () => {
         .simulate('change', { target: { value: 'notes' } });
 
       expect(wrapper.find('EuiButtonGroup[idSelected="notes"]').exists()).toBeTruthy();
-      expect(wrapper.find('.euiMarkdownFormat').text()).toEqual(
+      expect(wrapper.find('div.euiMarkdownFormat').text()).toEqual(
         'this is some markdown documentation'
       );
     });
diff --git a/x-pack/plugins/security_solution/public/detections/components/take_action_dropdown/helpers.ts b/x-pack/plugins/security_solution/public/detections/components/take_action_dropdown/helpers.ts
new file mode 100644
index 00000000000000..22f147494a2d63
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/take_action_dropdown/helpers.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ACTION_ADD_TO_CASE } from '../alerts_table/translations';
+
+export const addToCaseActionItem = (timelineId: string | null | undefined) =>
+  ['detections-page', 'detections-rules-details-page', 'timeline-1'].includes(timelineId ?? '')
+    ? [
+        {
+          name: ACTION_ADD_TO_CASE,
+          panel: 2,
+        },
+      ]
+    : [];
diff --git a/x-pack/plugins/security_solution/public/detections/components/take_action_dropdown/index.tsx b/x-pack/plugins/security_solution/public/detections/components/take_action_dropdown/index.tsx
new file mode 100644
index 00000000000000..d0f26894bf7d29
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/take_action_dropdown/index.tsx
@@ -0,0 +1,239 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useState, useCallback, useMemo } from 'react';
+import { EuiContextMenu, EuiButton, EuiPopover } from '@elastic/eui';
+import type { ExceptionListType } from '@kbn/securitysolution-io-ts-list-types';
+
+import { TAKE_ACTION } from '../alerts_table/alerts_utility_bar/translations';
+
+import { TimelineEventsDetailsItem, TimelineNonEcsData } from '../../../../common';
+import { useExceptionActions } from '../alerts_table/timeline_actions/use_add_exception_actions';
+import { useAlertsActions } from '../alerts_table/timeline_actions/use_alerts_actions';
+import { useInvestigateInTimeline } from '../alerts_table/timeline_actions/use_investigate_in_timeline';
+/* Todo: Uncomment case action after getAddToCaseAction is split into action and modal
+import {
+    ACTION_ADD_TO_CASE
+} from '../alerts_table/translations';
+import { useGetUserCasesPermissions, useKibana } from '../../../common/lib/kibana';
+import { useInsertTimeline } from '../../../cases/components/use_insert_timeline';
+import { addToCaseActionItem } from './helpers'; */
+import { useEventFilterAction } from '../alerts_table/timeline_actions/use_event_filter_action';
+import { useHostIsolationAction } from '../host_isolation/use_host_isolation_action';
+import { CHANGE_ALERT_STATUS } from './translations';
+import { getFieldValue } from '../host_isolation/helpers';
+import type { Ecs } from '../../../../common/ecs';
+import { Status } from '../../../../common/detection_engine/schemas/common/schemas';
+import { endpointAlertCheck } from '../../../common/utils/endpoint_alert_check';
+
+interface ActionsData {
+  alertStatus: Status;
+  eventId: string;
+  eventKind: string;
+  ruleId: string;
+  ruleName: string;
+}
+
+export const TakeActionDropdown = React.memo(
+  ({
+    detailsData,
+    ecsData,
+    handleOnEventClosed,
+    isHostIsolationPanelOpen,
+    loadingEventDetails,
+    nonEcsData,
+    onAddEventFilterClick,
+    onAddExceptionTypeClick,
+    onAddIsolationStatusClick,
+    refetch,
+    timelineId,
+  }: {
+    detailsData: TimelineEventsDetailsItem[] | null;
+    ecsData?: Ecs;
+    handleOnEventClosed: () => void;
+    isHostIsolationPanelOpen: boolean;
+    loadingEventDetails: boolean;
+    nonEcsData?: TimelineNonEcsData[];
+    refetch: (() => void) | undefined;
+    onAddEventFilterClick: () => void;
+    onAddExceptionTypeClick: (type: ExceptionListType) => void;
+    onAddIsolationStatusClick: (action: 'isolateHost' | 'unisolateHost') => void;
+    timelineId: string;
+  }) => {
+    /* Todo: Uncomment case action after getAddToCaseAction is split into action and modal
+    const casePermissions = useGetUserCasesPermissions();
+    const { timelines: timelinesUi } = useKibana().services;
+    const insertTimelineHook = useInsertTimeline;
+    */
+    const [isPopoverOpen, setIsPopoverOpen] = useState(false);
+
+    const actionsData = useMemo(
+      () =>
+        [
+          { category: 'signal', field: 'signal.rule.id', name: 'ruleId' },
+          { category: 'signal', field: 'signal.rule.name', name: 'ruleName' },
+          { category: 'signal', field: 'signal.status', name: 'alertStatus' },
+          { category: 'event', field: 'event.kind', name: 'eventKind' },
+          { category: '_id', field: '_id', name: 'eventId' },
+        ].reduce<ActionsData>(
+          (acc, curr) => ({
+            ...acc,
+            [curr.name]: getFieldValue({ category: curr.category, field: curr.field }, detailsData),
+          }),
+          {} as ActionsData
+        ),
+      [detailsData]
+    );
+
+    const alertIds = useMemo(() => [actionsData.eventId], [actionsData.eventId]);
+    const isEvent = actionsData.eventKind === 'event';
+
+    const isEndpointAlert = useMemo((): boolean => {
+      if (detailsData == null) {
+        return false;
+      }
+      return endpointAlertCheck({ data: detailsData });
+    }, [detailsData]);
+
+    const togglePopoverHandler = useCallback(() => {
+      setIsPopoverOpen(!isPopoverOpen);
+    }, [isPopoverOpen]);
+
+    const closePopoverHandler = useCallback(() => {
+      setIsPopoverOpen(false);
+    }, []);
+
+    const closePopoverAndFlyout = useCallback(() => {
+      handleOnEventClosed();
+      setIsPopoverOpen(false);
+    }, [handleOnEventClosed]);
+
+    const handleOnAddIsolationStatusClick = useCallback(
+      (action: 'isolateHost' | 'unisolateHost') => {
+        onAddIsolationStatusClick(action);
+        setIsPopoverOpen(false);
+      },
+      [onAddIsolationStatusClick]
+    );
+
+    const hostIsolationAction = useHostIsolationAction({
+      closePopover: closePopoverHandler,
+      detailsData,
+      onAddIsolationStatusClick: handleOnAddIsolationStatusClick,
+      isHostIsolationPanelOpen,
+    });
+
+    const handleOnAddExceptionTypeClick = useCallback(
+      (type: ExceptionListType) => {
+        onAddExceptionTypeClick(type);
+        setIsPopoverOpen(false);
+      },
+      [onAddExceptionTypeClick]
+    );
+
+    const exceptionActions = useExceptionActions({
+      isEndpointAlert,
+      onAddExceptionTypeClick: handleOnAddExceptionTypeClick,
+    });
+
+    const handleOnAddEventFilterClick = useCallback(() => {
+      onAddEventFilterClick();
+      setIsPopoverOpen(false);
+    }, [onAddEventFilterClick]);
+
+    const eventFilterActions = useEventFilterAction({
+      onAddEventFilterClick: handleOnAddEventFilterClick,
+    });
+
+    const { statusActions } = useAlertsActions({
+      alertStatus: actionsData.alertStatus,
+      eventId: actionsData.eventId,
+      timelineId,
+      closePopover: closePopoverAndFlyout,
+    });
+
+    const { investigateInTimelineAction } = useInvestigateInTimeline({
+      alertIds,
+      ecsRowData: ecsData,
+      onInvestigateInTimelineAlertClick: closePopoverHandler,
+    });
+
+    const alertsActionItems = useMemo(
+      () =>
+        !isEvent && actionsData.ruleId
+          ? [
+              {
+                name: CHANGE_ALERT_STATUS,
+                panel: 1,
+              },
+              ...exceptionActions,
+            ]
+          : [eventFilterActions],
+      [eventFilterActions, exceptionActions, isEvent, actionsData.ruleId]
+    );
+
+    const panels = useMemo(
+      () => [
+        {
+          id: 0,
+          items: [
+            ...alertsActionItems,
+            /* Todo: Uncomment case action after getAddToCaseAction is split into action and modal
+            ...addToCaseActionItem(timelineId),*/
+            ...hostIsolationAction,
+            ...investigateInTimelineAction,
+          ],
+        },
+        {
+          id: 1,
+          title: CHANGE_ALERT_STATUS,
+          items: statusActions,
+        },
+        /* Todo: Uncomment case action after getAddToCaseAction is split into action and modal
+        {
+          id: 2,
+          title: ACTION_ADD_TO_CASE,
+          content: (
+            <>
+              {ecsData &&
+                timelinesUi.getAddToCaseAction({
+                  ecsRowData: ecsData,
+                  useInsertTimeline: insertTimelineHook,
+                  casePermissions,
+                  showIcon: false,
+                })}
+            </>
+          ),
+        },*/
+      ],
+      [alertsActionItems, hostIsolationAction, investigateInTimelineAction, statusActions]
+    );
+
+    const takeActionButton = useMemo(() => {
+      return (
+        <EuiButton iconSide="right" fill iconType="arrowDown" onClick={togglePopoverHandler}>
+          {TAKE_ACTION}
+        </EuiButton>
+      );
+    }, [togglePopoverHandler]);
+
+    return panels[0].items?.length && !loadingEventDetails ? (
+      <>
+        <EuiPopover
+          id="hostIsolationTakeActionPanel"
+          button={takeActionButton}
+          isOpen={isPopoverOpen}
+          closePopover={closePopoverHandler}
+          panelPaddingSize="none"
+          anchorPosition="downLeft"
+        >
+          <EuiContextMenu size="s" initialPanelId={0} panels={panels} />
+        </EuiPopover>
+      </>
+    ) : null;
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/detections/components/take_action_dropdown/translations.ts b/x-pack/plugins/security_solution/public/detections/components/take_action_dropdown/translations.ts
new file mode 100644
index 00000000000000..f8ddb98a7ed86c
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/take_action_dropdown/translations.ts
@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const CHANGE_ALERT_STATUS = i18n.translate(
+  'xpack.securitySolution.endpoint.takeAction.changeAlertStatus',
+  {
+    defaultMessage: 'Change alert status',
+  }
+);
+
+export const ACTION_ADD_ENDPOINT_EXCEPTION = i18n.translate(
+  'xpack.securitySolution.endpoint.takeAction.addEndpointException',
+  {
+    defaultMessage: 'Add Endpoint exception',
+  }
+);
+
+export const ACTION_ADD_EXCEPTION = i18n.translate(
+  'xpack.securitySolution.endpoint.takeAction.addException',
+  {
+    defaultMessage: 'Add rule exception',
+  }
+);
+
+export const ACTION_ADD_EVENT_FILTER = i18n.translate(
+  'xpack.securitySolution.endpoint.takeAction.addEventFilter',
+  {
+    defaultMessage: 'Add Endpoint event filter',
+  }
+);
+
+export const INVESTIGATE_IN_TIMELINE = i18n.translate(
+  'xpack.securitySolution.endpoint.takeAction.investigateInTimeline',
+  {
+    defaultMessage: 'investigate in timeline',
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/api.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/api.ts
index 72a9bf6e84441b..3d4a7dba0de57e 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/api.ts
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/api.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { UpdateDocumentByQueryResponse } from 'elasticsearch';
+import type { estypes } from '@elastic/elasticsearch';
 import { getCasesFromAlertsUrl } from '../../../../../../cases/common';
 import { HostIsolationResponse, HostInfo } from '../../../../../common/endpoint/types';
 import {
@@ -62,7 +62,7 @@ export const updateAlertStatus = async ({
   query,
   status,
   signal,
-}: UpdateAlertStatusProps): Promise<UpdateDocumentByQueryResponse> =>
+}: UpdateAlertStatusProps): Promise<estypes.UpdateByQueryResponse> =>
   KibanaServices.get().http.fetch(DETECTION_ENGINE_SIGNALS_STATUS_URL, {
     method: 'POST',
     body: JSON.stringify({ conflicts: 'proceed', status, ...query }),
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_fetch_ecs_alerts_data.ts b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_fetch_ecs_alerts_data.ts
new file mode 100644
index 00000000000000..8af47812849248
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_fetch_ecs_alerts_data.ts
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { useEffect, useState } from 'react';
+import { SearchResponse } from 'elasticsearch';
+import { isEmpty } from 'lodash';
+
+import {
+  buildAlertsQuery,
+  formatAlertToEcsSignal,
+} from '../../../../cases/components/case_view/helpers';
+import { Ecs } from '../../../../../common/ecs';
+
+import { DETECTION_ENGINE_QUERY_SIGNALS_URL } from '../../../../../common/constants';
+import { KibanaServices } from '../../../../common/lib/kibana';
+
+export const useFetchEcsAlertsData = ({
+  alertIds,
+  skip,
+  onError,
+}: {
+  alertIds?: string[] | null | undefined;
+  skip?: boolean;
+  onError?: (e: Error) => void;
+}): { isLoading: boolean | null; alertsEcsData: Ecs[] | null } => {
+  const [isLoading, setIsLoading] = useState<boolean | null>(null);
+  const [alertsEcsData, setAlertEcsData] = useState<Ecs[] | null>(null);
+
+  useEffect(() => {
+    let isSubscribed = true;
+    const abortCtrl = new AbortController();
+
+    const fetchAlert = async () => {
+      try {
+        setIsLoading(true);
+        const alertResponse = await KibanaServices.get().http.fetch<
+          SearchResponse<{ '@timestamp': string; [key: string]: unknown }>
+        >(DETECTION_ENGINE_QUERY_SIGNALS_URL, {
+          method: 'POST',
+          body: JSON.stringify(buildAlertsQuery(alertIds ?? [])),
+        });
+
+        setAlertEcsData(
+          alertResponse?.hits.hits.reduce<Ecs[]>(
+            (acc, { _id, _index, _source }) => [
+              ...acc,
+              {
+                ...formatAlertToEcsSignal(_source as {}),
+                _id,
+                _index,
+                timestamp: _source['@timestamp'],
+              },
+            ],
+            []
+          ) ?? []
+        );
+      } catch (e) {
+        if (isSubscribed) {
+          if (onError) {
+            onError(e);
+          }
+        }
+      }
+      if (isSubscribed) {
+        setIsLoading(false);
+      }
+    };
+
+    if (!isEmpty(alertIds) && !skip) {
+      fetchAlert();
+    }
+
+    return (): void => {
+      isSubscribed = false;
+      abortCtrl.abort();
+    };
+  }, [alertIds, onError, skip]);
+
+  return {
+    isLoading,
+    alertsEcsData,
+  };
+};
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_host_isolation_status.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_host_isolation_status.tsx
index 6a40898d0a109f..4737f13c9c5965 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_host_isolation_status.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_host_isolation_status.tsx
@@ -38,6 +38,8 @@ export const useHostIsolationStatus = ({
     // isMounted tracks if a component is mounted before changing state
     let isMounted = true;
     let fleetAgentId: string;
+    setLoading(true);
+
     const fetchData = async () => {
       try {
         const metadataResponse = await getHostMetadata({ agentId, signal: abortCtrl.signal });
@@ -73,15 +75,9 @@ export const useHostIsolationStatus = ({
       }
     };
 
-    setLoading((prevState) => {
-      if (prevState) {
-        return prevState;
-      }
-      if (!isEmpty(agentId)) {
-        fetchData();
-      }
-      return true;
-    });
+    if (!isEmpty(agentId)) {
+      fetchData();
+    }
     return () => {
       // updates to show component is unmounted
       isMounted = false;
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_no_index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_no_index.tsx
index b65cb5069d399b..19219208b4079a 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_no_index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_no_index.tsx
@@ -33,7 +33,7 @@ const DetectionEngineNoIndexComponent: React.FC<{
       detections: {
         icon: 'documents',
         label: i18n.GO_TO_DOCUMENTATION,
-        url: `${docLinks.ELASTIC_WEBSITE_URL}guide/en/security/${docLinks.DOC_LINK_VERSION}/detections-permissions-section.html`,
+        url: `${docLinks.links.siem.detectionsReq}`,
         target: '_blank',
       },
     }),
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx
index 19dd14c46a4a94..c725bae54b06c7 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx
@@ -18,7 +18,7 @@ export const DetectionEngineUserUnauthenticated = React.memo(() => {
       detectionUnauthenticated: {
         icon: 'documents',
         label: i18n.GO_TO_DOCUMENTATION,
-        url: `${docLinks.ELASTIC_WEBSITE_URL}guide/en/security/${docLinks.DOC_LINK_VERSION}/detections-permissions-section.html`,
+        url: `${docLinks.links.siem.detectionsReq}`,
         target: '_blank',
       },
     }),
diff --git a/x-pack/plugins/security_solution/public/hosts/components/authentications_table/mock.ts b/x-pack/plugins/security_solution/public/hosts/components/authentications_table/mock.ts
index 68cbaf5bf26266..f2b004f856cc4a 100644
--- a/x-pack/plugins/security_solution/public/hosts/components/authentications_table/mock.ts
+++ b/x-pack/plugins/security_solution/public/hosts/components/authentications_table/mock.ts
@@ -5,12 +5,24 @@
  * 2.0.
  */
 
-import { SearchResponse } from 'elasticsearch';
+import type { estypes } from '@elastic/elasticsearch';
 import { HostAuthenticationsStrategyResponse } from '../../../../common/search_strategy/security_solution/hosts/authentications';
 
 export const mockData: { Authentications: HostAuthenticationsStrategyResponse } = {
   Authentications: {
     rawResponse: {
+      took: 880,
+      timed_out: false,
+      _shards: {
+        total: 26,
+        successful: 26,
+        skipped: 0,
+        failed: 0,
+      },
+      hits: {
+        total: 2,
+        hits: [],
+      },
       aggregations: {
         group_by_users: {
           buckets: [
@@ -32,7 +44,7 @@ export const mockData: { Authentications: HostAuthenticationsStrategyResponse }
           sum_other_doc_count: 566,
         },
       },
-    } as SearchResponse<unknown>,
+    } as estypes.SearchResponse<unknown>,
     totalCount: 54,
     edges: [
       {
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx b/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx
index 3acf307cb9f418..2dc254f7a35ed8 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/navigation/events_query_tab_body.tsx
@@ -26,6 +26,7 @@ import { DefaultCellRenderer } from '../../../timelines/components/timeline/cell
 import { SourcererScopeName } from '../../../common/store/sourcerer/model';
 import { useIsExperimentalFeatureEnabled } from '../../../common/hooks/use_experimental_features';
 import { DEFAULT_COLUMN_MIN_WIDTH } from '../../../timelines/components/timeline/body/constants';
+import { defaultCellActions } from '../../../common/lib/cell_actions/default_cell_actions';
 
 const EVENTS_HISTOGRAM_ID = 'eventsHistogramQuery';
 
@@ -108,6 +109,7 @@ const EventsQueryTabBodyComponent: React.FC<HostsComponentsQueryProps> = ({
         />
       )}
       <StatefulEventsViewer
+        defaultCellActions={defaultCellActions}
         defaultModel={eventsDefaultModel}
         end={endDate}
         id={TimelineId.hostsPageEvents}
diff --git a/x-pack/plugins/security_solution/public/management/common/routing.test.ts b/x-pack/plugins/security_solution/public/management/common/routing.test.ts
index 82b7a15d642e40..e0e6ed2a080371 100644
--- a/x-pack/plugins/security_solution/public/management/common/routing.test.ts
+++ b/x-pack/plugins/security_solution/public/management/common/routing.test.ts
@@ -106,26 +106,28 @@ describe('routing', () => {
     });
 
     it('builds proper path when only page size provided', () => {
-      expect(getTrustedAppsListPath({ page_size: 20 })).toEqual(
-        '/administration/trusted_apps?page_size=20'
+      const pageSize = 20;
+      expect(getTrustedAppsListPath({ page_size: pageSize })).toEqual(
+        `/administration/trusted_apps?page_size=${pageSize}`
       );
     });
 
     it('builds proper path when only page index provided', () => {
-      expect(getTrustedAppsListPath({ page_index: 2 })).toEqual(
-        '/administration/trusted_apps?page_index=2'
+      const pageIndex = 2;
+      expect(getTrustedAppsListPath({ page_index: pageIndex })).toEqual(
+        `/administration/trusted_apps?page_index=${pageIndex}`
       );
     });
 
     it('builds proper path when only "show" provided', () => {
-      expect(getTrustedAppsListPath({ show: 'create' })).toEqual(
-        '/administration/trusted_apps?show=create'
-      );
+      const show = 'create';
+      expect(getTrustedAppsListPath({ show })).toEqual(`/administration/trusted_apps?show=${show}`);
     });
 
     it('builds proper path when only view type provided', () => {
-      expect(getTrustedAppsListPath({ view_type: 'list' })).toEqual(
-        '/administration/trusted_apps?view_type=list'
+      const viewType = 'list';
+      expect(getTrustedAppsListPath({ view_type: viewType })).toEqual(
+        `/administration/trusted_apps?view_type=${viewType}`
       );
     });
 
@@ -135,56 +137,82 @@ describe('routing', () => {
         page_size: 20,
         show: 'create',
         view_type: 'list',
-        filter: '',
+        filter: 'test',
+        included_policies: 'globally',
+        excluded_policies: 'unassigned',
       };
 
       expect(getTrustedAppsListPath(location)).toEqual(
-        '/administration/trusted_apps?page_index=2&page_size=20&view_type=list&show=create'
+        `/administration/trusted_apps?page_index=${location.page_index}&page_size=${location.page_size}&view_type=${location.view_type}&show=${location.show}&filter=${location.filter}&included_policies=${location.included_policies}&excluded_policies=${location.excluded_policies}`
       );
     });
 
     it('builds proper path when page index is equal to default', () => {
-      const path = getTrustedAppsListPath({
+      const location: TrustedAppsListPageLocation = {
         page_index: MANAGEMENT_DEFAULT_PAGE,
         page_size: 20,
         show: 'create',
         view_type: 'list',
-      });
+        filter: '',
+        included_policies: '',
+        excluded_policies: '',
+      };
+      const path = getTrustedAppsListPath(location);
 
-      expect(path).toEqual('/administration/trusted_apps?page_size=20&view_type=list&show=create');
+      expect(path).toEqual(
+        `/administration/trusted_apps?page_size=${location.page_size}&view_type=${location.view_type}&show=${location.show}`
+      );
     });
 
     it('builds proper path when page size is equal to default', () => {
-      const path = getTrustedAppsListPath({
+      const location: TrustedAppsListPageLocation = {
         page_index: 2,
         page_size: MANAGEMENT_DEFAULT_PAGE_SIZE,
         show: 'create',
         view_type: 'list',
-      });
+        filter: '',
+        included_policies: '',
+        excluded_policies: '',
+      };
+      const path = getTrustedAppsListPath(location);
 
-      expect(path).toEqual('/administration/trusted_apps?page_index=2&view_type=list&show=create');
+      expect(path).toEqual(
+        `/administration/trusted_apps?page_index=${location.page_index}&view_type=${location.view_type}&show=${location.show}`
+      );
     });
 
     it('builds proper path when "show" is equal to default', () => {
-      const path = getTrustedAppsListPath({
+      const location: TrustedAppsListPageLocation = {
         page_index: 2,
         page_size: 20,
         show: undefined,
         view_type: 'list',
-      });
+        filter: '',
+        included_policies: '',
+        excluded_policies: '',
+      };
+      const path = getTrustedAppsListPath(location);
 
-      expect(path).toEqual('/administration/trusted_apps?page_index=2&page_size=20&view_type=list');
+      expect(path).toEqual(
+        `/administration/trusted_apps?page_index=${location.page_index}&page_size=${location.page_size}&view_type=${location.view_type}`
+      );
     });
 
     it('builds proper path when view type is equal to default', () => {
-      const path = getTrustedAppsListPath({
+      const location: TrustedAppsListPageLocation = {
         page_index: 2,
         page_size: 20,
         show: 'create',
         view_type: 'grid',
-      });
+        filter: '',
+        included_policies: '',
+        excluded_policies: '',
+      };
+      const path = getTrustedAppsListPath(location);
 
-      expect(path).toEqual('/administration/trusted_apps?page_index=2&page_size=20&show=create');
+      expect(path).toEqual(
+        `/administration/trusted_apps?page_index=${location.page_index}&page_size=${location.page_size}&show=${location.show}`
+      );
     });
 
     it('builds proper path when params are equal to default', () => {
diff --git a/x-pack/plugins/security_solution/public/management/common/routing.ts b/x-pack/plugins/security_solution/public/management/common/routing.ts
index e6c02ffefa3c51..d044fc0f1f2f60 100644
--- a/x-pack/plugins/security_solution/public/management/common/routing.ts
+++ b/x-pack/plugins/security_solution/public/management/common/routing.ts
@@ -140,6 +140,12 @@ const normalizeTrustedAppsPageLocation = (
       ...(!isDefaultOrMissing(location.show, undefined) ? { show: location.show } : {}),
       ...(!isDefaultOrMissing(location.id, undefined) ? { id: location.id } : {}),
       ...(!isDefaultOrMissing(location.filter, '') ? { filter: location.filter } : ''),
+      ...(!isDefaultOrMissing(location.included_policies, '')
+        ? { included_policies: location.included_policies }
+        : ''),
+      ...(!isDefaultOrMissing(location.excluded_policies, '')
+        ? { excluded_policies: location.excluded_policies }
+        : ''),
     };
   } else {
     return {};
@@ -196,12 +202,26 @@ const extractFilter = (query: querystring.ParsedUrlQuery): string => {
   return extractFirstParamValue(query, 'filter') || '';
 };
 
+const extractIncludedPolicies = (query: querystring.ParsedUrlQuery): string => {
+  return extractFirstParamValue(query, 'included_policies') || '';
+};
+
+const extractExcludedPolicies = (query: querystring.ParsedUrlQuery): string => {
+  return extractFirstParamValue(query, 'excluded_policies') || '';
+};
+
 export const extractListPaginationParams = (query: querystring.ParsedUrlQuery) => ({
   page_index: extractPageIndex(query),
   page_size: extractPageSize(query),
   filter: extractFilter(query),
 });
 
+export const extractTrustedAppsListPaginationParams = (query: querystring.ParsedUrlQuery) => ({
+  ...extractListPaginationParams(query),
+  included_policies: extractIncludedPolicies(query),
+  excluded_policies: extractExcludedPolicies(query),
+});
+
 export const extractTrustedAppsListPageLocation = (
   query: querystring.ParsedUrlQuery
 ): TrustedAppsListPageLocation => {
@@ -211,7 +231,7 @@ export const extractTrustedAppsListPageLocation = (
   ) as TrustedAppsListPageLocation['show'];
 
   return {
-    ...extractListPaginationParams(query),
+    ...extractTrustedAppsListPaginationParams(query),
     view_type: extractFirstParamValue(query, 'view_type') === 'list' ? 'list' : 'grid',
     show:
       showParamValue && ['edit', 'create'].includes(showParamValue) ? showParamValue : undefined,
diff --git a/x-pack/plugins/security_solution/public/management/common/utils.ts b/x-pack/plugins/security_solution/public/management/common/utils.ts
index 616e395c8ad479..3fbe5662f338c8 100644
--- a/x-pack/plugins/security_solution/public/management/common/utils.ts
+++ b/x-pack/plugins/security_solution/public/management/common/utils.ts
@@ -5,6 +5,8 @@
  * 2.0.
  */
 
+import { isEmpty } from 'lodash/fp';
+
 export const parseQueryFilterToKQL = (filter: string, fields: Readonly<string[]>): string => {
   if (!filter) return '';
   const kuery = fields
@@ -19,3 +21,31 @@ export const parseQueryFilterToKQL = (filter: string, fields: Readonly<string[]>
 
   return `(${kuery})`;
 };
+
+const getPolicyQuery = (policyId: string): string => {
+  if (policyId === 'global') return 'exception-list-agnostic.attributes.tags:"policy:all"';
+  if (policyId === 'unassigned') return '(not exception-list-agnostic.attributes.tags:*)';
+  return `exception-list-agnostic.attributes.tags:"policy:${policyId}"`;
+};
+
+export const parsePoliciesToKQL = (includedPolicies: string, excludedPolicies: string): string => {
+  if (isEmpty(includedPolicies) && isEmpty(excludedPolicies)) return '';
+
+  const parsedIncludedPolicies = includedPolicies ? includedPolicies.split(',') : undefined;
+  const parsedExcludedPolicies = excludedPolicies ? excludedPolicies.split(',') : undefined;
+
+  const includedPoliciesKuery = parsedIncludedPolicies
+    ? parsedIncludedPolicies.map(getPolicyQuery).join(' OR ')
+    : '';
+
+  const excludedPoliciesKuery = parsedExcludedPolicies
+    ? parsedExcludedPolicies.map((policyId) => `not ${getPolicyQuery(policyId)}`).join(' AND ')
+    : '';
+
+  const kuery = [];
+
+  if (includedPoliciesKuery) kuery.push(includedPoliciesKuery);
+  if (excludedPoliciesKuery) kuery.push(excludedPoliciesKuery);
+
+  return `(${kuery.join(' AND ')})`;
+};
diff --git a/x-pack/plugins/security_solution/public/management/components/management_empty_state.tsx b/x-pack/plugins/security_solution/public/management/components/management_empty_state.tsx
index a3b1597377fa09..33e2980dcc1124 100644
--- a/x-pack/plugins/security_solution/public/management/components/management_empty_state.tsx
+++ b/x-pack/plugins/security_solution/public/management/components/management_empty_state.tsx
@@ -24,6 +24,7 @@ import {
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import onboardingLogo from '../images/security_administration_onboarding.svg';
+import { useKibana } from '../../common/lib/kibana';
 
 const TEXT_ALIGN_CENTER: CSSProperties = Object.freeze({
   textAlign: 'center',
@@ -44,6 +45,7 @@ const PolicyEmptyState = React.memo<{
   onActionClick: (event: MouseEvent<HTMLAnchorElement | HTMLButtonElement>) => void;
   actionDisabled?: boolean;
 }>(({ loading, onActionClick, actionDisabled }) => {
+  const docLinks = useKibana().services.docLinks;
   return (
     <div data-test-subj="emptyPolicyTable">
       {loading ? (
@@ -83,7 +85,7 @@ const PolicyEmptyState = React.memo<{
                 id="xpack.securitySolution.endpoint.policyList.onboardingSectionThree"
                 defaultMessage="To get started, add the Endpoint Security integration to your Agents. For more information, "
               />
-              <EuiLink external href="https://www.elastic.co/guide/en/security/current/index.html">
+              <EuiLink external href={`${docLinks.links.siem.guide}`}>
                 <FormattedMessage
                   id="xpack.securitySolution.endpoint.policyList.onboardingDocsLink"
                   defaultMessage="view the Elastic Security documentation"
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/index.ts b/x-pack/plugins/security_solution/public/management/components/policies_selector/index.ts
similarity index 51%
rename from x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/index.ts
rename to x-pack/plugins/security_solution/public/management/components/policies_selector/index.ts
index 12ee58cb81b9b3..1b25a8af9d3fcc 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/policy_table/index.ts
+++ b/x-pack/plugins/security_solution/public/management/components/policies_selector/index.ts
@@ -5,11 +5,4 @@
  * 2.0.
  */
 
-import { PolicyFromES } from '../../../../common/types';
-
-export { PolicyTable } from './policy_table.container';
-
-export type TableColumn = Extract<
-  keyof PolicyFromES,
-  'version' | 'name' | 'indices' | 'indexTemplates' | 'modifiedDate'
->;
+export { PoliciesSelector, PolicySelectionItem, PoliciesSelectorProps } from './policies_selector';
diff --git a/x-pack/plugins/security_solution/public/management/components/policies_selector/policies_selector.test.tsx b/x-pack/plugins/security_solution/public/management/components/policies_selector/policies_selector.test.tsx
new file mode 100644
index 00000000000000..f93c7399cac335
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/components/policies_selector/policies_selector.test.tsx
@@ -0,0 +1,128 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { I18nProvider } from '@kbn/i18n/react';
+import { render, act, fireEvent, RenderResult } from '@testing-library/react';
+import React from 'react';
+import { EndpointDocGenerator } from '../../../../common/endpoint/generate_data';
+
+import { PoliciesSelector, PoliciesSelectorProps } from '.';
+import { useIsExperimentalFeatureEnabled } from '../../../common/hooks/use_experimental_features';
+
+// TODO: remove this mock when feature flag is removed
+jest.mock('../../../common/hooks/use_experimental_features');
+const useIsExperimentalFeatureEnabledMock = useIsExperimentalFeatureEnabled as jest.Mock;
+
+let onChangeSelectionMock: jest.Mock;
+
+describe('Policies selector', () => {
+  let getElement: (params: Partial<PoliciesSelectorProps>) => RenderResult;
+  beforeEach(() => {
+    onChangeSelectionMock = jest.fn();
+    useIsExperimentalFeatureEnabledMock.mockReturnValue(false);
+    getElement = (params: Partial<PoliciesSelectorProps>) => {
+      return render(
+        <I18nProvider>
+          <PoliciesSelector
+            policies={[policy]}
+            onChangeSelection={onChangeSelectionMock}
+            {...params}
+          />
+        </I18nProvider>
+      );
+    };
+  });
+  const generator = new EndpointDocGenerator('policy-list');
+  const policy = generator.generatePolicyPackagePolicy();
+  policy.name = 'test policy A';
+  policy.id = 'abc123';
+
+  describe('When click on policy', () => {
+    it('should have a default value', () => {
+      const defaultIncludedPolicies = 'abc123';
+      const defaultExcludedPolicies = 'global';
+      const element = getElement({ defaultExcludedPolicies, defaultIncludedPolicies });
+      act(() => {
+        fireEvent.click(element.getByTestId('policiesSelectorButton'));
+      });
+      expect(element.getByText(policy.name)).toHaveTextContent(policy.name);
+      act(() => {
+        fireEvent.click(element.getByText('Unassigned entries'));
+      });
+      expect(onChangeSelectionMock).toHaveBeenCalledWith([
+        { checked: 'on', id: 'abc123', name: 'test policy A' },
+        { checked: 'off', id: 'global', name: 'Global entries' },
+        { checked: 'on', id: 'unassigned', name: 'Unassigned entries' },
+      ]);
+    });
+
+    it('should disable enabled default value', () => {
+      useIsExperimentalFeatureEnabledMock.mockReturnValue(true);
+      const defaultIncludedPolicies = 'abc123';
+      const defaultExcludedPolicies = 'global';
+      const element = getElement({ defaultExcludedPolicies, defaultIncludedPolicies });
+      act(() => {
+        fireEvent.click(element.getByTestId('policiesSelectorButton'));
+      });
+      act(() => {
+        fireEvent.click(element.getByText(policy.name));
+      });
+      expect(onChangeSelectionMock).toHaveBeenCalledWith([
+        { checked: 'off', id: 'abc123', name: 'test policy A' },
+        { checked: 'off', id: 'global', name: 'Global entries' },
+        { checked: undefined, id: 'unassigned', name: 'Unassigned entries' },
+      ]);
+    });
+
+    it('should remove disabled default value', () => {
+      const defaultIncludedPolicies = 'abc123';
+      const defaultExcludedPolicies = 'global';
+      const element = getElement({ defaultExcludedPolicies, defaultIncludedPolicies });
+      act(() => {
+        fireEvent.click(element.getByTestId('policiesSelectorButton'));
+      });
+      act(() => {
+        fireEvent.click(element.getByText('Global entries'));
+      });
+      expect(onChangeSelectionMock).toHaveBeenCalledWith([
+        { checked: 'on', id: 'abc123', name: 'test policy A' },
+        { checked: undefined, id: 'global', name: 'Global entries' },
+        { checked: undefined, id: 'unassigned', name: 'Unassigned entries' },
+      ]);
+    });
+  });
+
+  describe('When filter policy', () => {
+    it('should filter policy by name', () => {
+      const element = getElement({});
+      act(() => {
+        fireEvent.click(element.getByTestId('policiesSelectorButton'));
+      });
+      act(() => {
+        fireEvent.change(element.getByTestId('policiesSelectorSearch'), {
+          target: { value: policy.name },
+        });
+      });
+      expect(element.queryAllByText('Global entries')).toStrictEqual([]);
+      expect(element.getByText(policy.name)).toHaveTextContent(policy.name);
+    });
+    it('should filter with no results', () => {
+      const element = getElement({});
+      act(() => {
+        fireEvent.click(element.getByTestId('policiesSelectorButton'));
+      });
+      act(() => {
+        fireEvent.change(element.getByTestId('policiesSelectorSearch'), {
+          target: { value: 'no results' },
+        });
+      });
+      expect(element.queryAllByText('Global entries')).toStrictEqual([]);
+      expect(element.queryAllByText('Unassigned entries')).toStrictEqual([]);
+      expect(element.queryAllByText(policy.name)).toStrictEqual([]);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/management/components/policies_selector/policies_selector.tsx b/x-pack/plugins/security_solution/public/management/components/policies_selector/policies_selector.tsx
new file mode 100644
index 00000000000000..b86c8f6de7abd1
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/components/policies_selector/policies_selector.tsx
@@ -0,0 +1,205 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { memo, useCallback, useMemo, useState, useEffect, ChangeEvent } from 'react';
+
+import { i18n } from '@kbn/i18n';
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFilterGroup,
+  EuiPopover,
+  EuiPopoverTitle,
+  EuiFieldSearch,
+  EuiFilterButton,
+  EuiFilterSelectItem,
+  FilterChecked,
+  EuiText,
+} from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { ImmutableArray, PolicyData } from '../../../../common/endpoint/types';
+import { useIsExperimentalFeatureEnabled } from '../../../common/hooks/use_experimental_features';
+
+export interface PoliciesSelectorProps {
+  policies: ImmutableArray<PolicyData>;
+  defaultIncludedPolicies?: string;
+  defaultExcludedPolicies?: string;
+  onChangeSelection: (items: PolicySelectionItem[]) => void;
+}
+
+export interface PolicySelectionItem {
+  name: string;
+  id?: string;
+  checked?: FilterChecked;
+}
+
+interface DefaultPoliciesByKey {
+  [key: string]: boolean;
+}
+
+const GLOBAL_ENTRIES = i18n.translate(
+  'xpack.securitySolution.management.policiesSelector.globalEntries',
+  {
+    defaultMessage: 'Global entries',
+  }
+);
+const UNASSIGNED_ENTRIES = i18n.translate(
+  'xpack.securitySolution.management.policiesSelector.unassignedEntries',
+  {
+    defaultMessage: 'Unassigned entries',
+  }
+);
+
+export const PoliciesSelector = memo<PoliciesSelectorProps>(
+  ({ policies, onChangeSelection, defaultExcludedPolicies, defaultIncludedPolicies }) => {
+    const [isPopoverOpen, setIsPopoverOpen] = useState(false);
+    const [query, setQuery] = useState<string>('');
+    const [itemsList, setItemsList] = useState<PolicySelectionItem[]>([]);
+
+    const isExcludePoliciesInFilterEnabled = useIsExperimentalFeatureEnabled(
+      'excludePoliciesInFilterEnabled'
+    );
+
+    useEffect(() => {
+      const defaultIncludedPoliciesByKey: DefaultPoliciesByKey = defaultIncludedPolicies
+        ? defaultIncludedPolicies.split(',').reduce((acc, val) => ({ ...acc, [val]: true }), {})
+        : {};
+
+      const defaultExcludedPoliciesByKey: DefaultPoliciesByKey = defaultExcludedPolicies
+        ? defaultExcludedPolicies.split(',').reduce((acc, val) => ({ ...acc, [val]: true }), {})
+        : {};
+
+      const getCheckedValue = (id: string): FilterChecked | undefined =>
+        defaultIncludedPoliciesByKey[id]
+          ? 'on'
+          : defaultExcludedPoliciesByKey[id]
+          ? 'off'
+          : undefined;
+
+      setItemsList([
+        ...policies.map((policy) => ({
+          name: policy.name,
+          id: policy.id,
+          checked: getCheckedValue(policy.id),
+        })),
+        { name: GLOBAL_ENTRIES, id: 'global', checked: getCheckedValue('global') },
+        { name: UNASSIGNED_ENTRIES, id: 'unassigned', checked: getCheckedValue('unassigned') },
+      ]);
+      // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [policies]);
+
+    const onButtonClick = useCallback(() => {
+      setIsPopoverOpen((prevIsPopoverOpen) => !prevIsPopoverOpen);
+    }, []);
+
+    const closePopover = useCallback(() => {
+      setIsPopoverOpen(false);
+    }, []);
+
+    const onChange = useCallback((ev: ChangeEvent<HTMLInputElement>) => {
+      const value = ev.target.value || '';
+      setQuery(value);
+    }, []);
+
+    const updateItem = useCallback(
+      (index: number) => {
+        if (!itemsList[index]) {
+          return;
+        }
+
+        const newItems = [...itemsList];
+
+        switch (newItems[index].checked) {
+          case 'on':
+            newItems[index].checked = isExcludePoliciesInFilterEnabled ? 'off' : undefined;
+            break;
+
+          case 'off':
+            newItems[index].checked = undefined;
+            break;
+
+          default:
+            newItems[index].checked = 'on';
+        }
+
+        setItemsList(newItems);
+        onChangeSelection(newItems);
+      },
+      [itemsList, onChangeSelection, isExcludePoliciesInFilterEnabled]
+    );
+
+    const dropdownItems = useMemo(
+      () =>
+        itemsList.map((item, index) =>
+          item.name.match(new RegExp(query, 'i')) ? (
+            <EuiFilterSelectItem
+              checked={item.checked}
+              key={index}
+              onClick={() => updateItem(index)}
+            >
+              {item.name}
+            </EuiFilterSelectItem>
+          ) : null
+        ),
+      [itemsList, query, updateItem]
+    );
+
+    const button = useMemo(
+      () => (
+        <EuiFilterButton
+          iconType="arrowDown"
+          data-test-subj="policiesSelectorButton"
+          onClick={onButtonClick}
+          isSelected={isPopoverOpen}
+          numFilters={itemsList.length}
+          hasActiveFilters={!!itemsList.find((item) => item.checked === 'on')}
+          numActiveFilters={itemsList.filter((item) => item.checked === 'on').length}
+        >
+          <EuiText>
+            <FormattedMessage
+              id="xpack.securitySolution.management.policiesSelector.label"
+              defaultMessage="Policies"
+            />
+          </EuiText>
+        </EuiFilterButton>
+      ),
+      [isPopoverOpen, itemsList, onButtonClick]
+    );
+
+    return (
+      <EuiFlexGroup
+        data-test-subj="policiesSelector"
+        direction="row"
+        alignItems="center"
+        gutterSize="l"
+      >
+        <EuiFlexItem>
+          <EuiFilterGroup>
+            <EuiPopover
+              button={button}
+              isOpen={isPopoverOpen}
+              closePopover={closePopover}
+              panelPaddingSize="none"
+            >
+              <EuiPopoverTitle paddingSize="s">
+                <EuiFieldSearch
+                  data-test-subj="policiesSelectorSearch"
+                  compressed
+                  onChange={onChange}
+                  value={query}
+                />
+              </EuiPopoverTitle>
+              <div className="euiFilterSelect__items">{dropdownItems}</div>
+            </EuiPopover>
+          </EuiFilterGroup>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    );
+  }
+);
+
+PoliciesSelector.displayName = 'PoliciesSelector';
diff --git a/x-pack/plugins/security_solution/public/management/components/search_bar/index.tsx b/x-pack/plugins/security_solution/public/management/components/search_bar/index.tsx
deleted file mode 100644
index 5ace2b901da11c..00000000000000
--- a/x-pack/plugins/security_solution/public/management/components/search_bar/index.tsx
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { memo, useCallback, useState } from 'react';
-import { EuiFlexGroup, EuiFlexItem, EuiFieldSearch, EuiButton } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-
-export interface SearchBarProps {
-  defaultValue?: string;
-  placeholder: string;
-  onSearch(value: string): void;
-}
-
-export const SearchBar = memo<SearchBarProps>(({ defaultValue = '', onSearch, placeholder }) => {
-  const [query, setQuery] = useState<string>(defaultValue);
-
-  const handleOnChangeSearchField = useCallback(
-    (ev: React.ChangeEvent<HTMLInputElement>) => setQuery(ev.target.value),
-    [setQuery]
-  );
-  const handleOnSearch = useCallback(() => onSearch(query), [query, onSearch]);
-
-  return (
-    <EuiFlexGroup data-test-subj="searchBar" direction="row" alignItems="center" gutterSize="l">
-      <EuiFlexItem>
-        <EuiFieldSearch
-          defaultValue={defaultValue}
-          placeholder={placeholder}
-          onChange={handleOnChangeSearchField}
-          onSearch={onSearch}
-          isClearable
-          fullWidth
-          data-test-subj="searchField"
-        />
-      </EuiFlexItem>
-      <EuiFlexItem grow={false} onClick={handleOnSearch} data-test-subj="searchButton">
-        <EuiButton iconType="refresh">
-          {i18n.translate('xpack.securitySolution.management.search.button', {
-            defaultMessage: 'Refresh',
-          })}
-        </EuiButton>
-      </EuiFlexItem>
-    </EuiFlexGroup>
-  );
-});
-
-SearchBar.displayName = 'SearchBar';
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/services/index.ts b/x-pack/plugins/security_solution/public/management/components/search_exceptions/index.ts
similarity index 74%
rename from x-pack/plugins/index_lifecycle_management/public/application/services/index.ts
rename to x-pack/plugins/security_solution/public/management/components/search_exceptions/index.ts
index 5086dcf052fa6a..6a870dbb06c66c 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/services/index.ts
+++ b/x-pack/plugins/security_solution/public/management/components/search_exceptions/index.ts
@@ -5,5 +5,4 @@
  * 2.0.
  */
 
-export { filterItems } from './filter_items';
-export { sortTable } from './sort_table';
+export { SearchExceptions, SearchExceptionsProps } from './search_exceptions';
diff --git a/x-pack/plugins/security_solution/public/management/components/search_bar/index.test.tsx b/x-pack/plugins/security_solution/public/management/components/search_exceptions/search_exceptions.test.tsx
similarity index 89%
rename from x-pack/plugins/security_solution/public/management/components/search_bar/index.test.tsx
rename to x-pack/plugins/security_solution/public/management/components/search_exceptions/search_exceptions.test.tsx
index 707a96938655a7..5c909e062ceb9c 100644
--- a/x-pack/plugins/security_solution/public/management/components/search_bar/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/components/search_exceptions/search_exceptions.test.tsx
@@ -8,7 +8,7 @@
 import { mount } from 'enzyme';
 import React from 'react';
 
-import { SearchBar } from '.';
+import { SearchExceptions } from '.';
 
 let onSearchMock: jest.Mock;
 
@@ -16,13 +16,17 @@ interface EuiFieldSearchPropsFake {
   onSearch(value: string): void;
 }
 
-describe('Search bar', () => {
+describe('Search exceptions', () => {
   beforeEach(() => {
     onSearchMock = jest.fn();
   });
 
   const getElement = (defaultValue: string = '') => (
-    <SearchBar defaultValue={defaultValue} onSearch={onSearchMock} placeholder={'placeholder'} />
+    <SearchExceptions
+      defaultValue={defaultValue}
+      onSearch={onSearchMock}
+      placeholder={'placeholder'}
+    />
   );
 
   it('should have a default value', () => {
@@ -45,7 +49,7 @@ describe('Search bar', () => {
     searchFieldProps.onSearch(expectedDefaultValue);
 
     expect(onSearchMock).toHaveBeenCalledTimes(1);
-    expect(onSearchMock).toHaveBeenCalledWith(expectedDefaultValue);
+    expect(onSearchMock).toHaveBeenCalledWith(expectedDefaultValue, '', '');
   });
 
   it('should dispatch search action when click on button', () => {
@@ -55,6 +59,6 @@ describe('Search bar', () => {
 
     element.find('[data-test-subj="searchButton"]').first().simulate('click');
     expect(onSearchMock).toHaveBeenCalledTimes(1);
-    expect(onSearchMock).toHaveBeenCalledWith(expectedDefaultValue);
+    expect(onSearchMock).toHaveBeenCalledWith(expectedDefaultValue, '', '');
   });
 });
diff --git a/x-pack/plugins/security_solution/public/management/components/search_exceptions/search_exceptions.tsx b/x-pack/plugins/security_solution/public/management/components/search_exceptions/search_exceptions.tsx
new file mode 100644
index 00000000000000..a737b53e2d9b9a
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/components/search_exceptions/search_exceptions.tsx
@@ -0,0 +1,116 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { memo, useCallback, useState } from 'react';
+import { EuiFlexGroup, EuiFlexItem, EuiFieldSearch, EuiButton } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { PolicySelectionItem, PoliciesSelector } from '../policies_selector';
+import { ImmutableArray, PolicyData } from '../../../../common/endpoint/types';
+
+export interface SearchExceptionsProps {
+  defaultValue?: string;
+  placeholder: string;
+  hasPolicyFilter?: boolean;
+  policyList?: ImmutableArray<PolicyData>;
+  defaultExcludedPolicies?: string;
+  defaultIncludedPolicies?: string;
+  onSearch(query: string, includedPolicies?: string, excludedPolicies?: string): void;
+}
+
+export const SearchExceptions = memo<SearchExceptionsProps>(
+  ({
+    defaultValue = '',
+    onSearch,
+    placeholder,
+    hasPolicyFilter,
+    policyList,
+    defaultIncludedPolicies,
+    defaultExcludedPolicies,
+  }) => {
+    const [query, setQuery] = useState<string>(defaultValue);
+    const [includedPolicies, setIncludedPolicies] = useState<string>(defaultIncludedPolicies || '');
+    const [excludedPolicies, setExcludedPolicies] = useState<string>(defaultExcludedPolicies || '');
+
+    const onChangeSelection = useCallback(
+      (items: PolicySelectionItem[]) => {
+        const includePoliciesNew = items
+          .filter((item) => item.checked === 'on')
+          .map((item) => item.id)
+          .join(',');
+        const excludePoliciesNew = items
+          .filter((item) => item.checked === 'off')
+          .map((item) => item.id)
+          .join(',');
+
+        setIncludedPolicies(includePoliciesNew);
+        setExcludedPolicies(excludePoliciesNew);
+
+        onSearch(query, includePoliciesNew, excludePoliciesNew);
+      },
+      [onSearch, query]
+    );
+
+    const handleOnChangeSearchField = useCallback(
+      (ev: React.ChangeEvent<HTMLInputElement>) => setQuery(ev.target.value),
+      [setQuery]
+    );
+    const handleOnSearch = useCallback(() => onSearch(query, includedPolicies, excludedPolicies), [
+      onSearch,
+      query,
+      includedPolicies,
+      excludedPolicies,
+    ]);
+
+    const handleOnSearchQuery = useCallback(
+      (value) => {
+        onSearch(value, includedPolicies, excludedPolicies);
+      },
+      [onSearch, includedPolicies, excludedPolicies]
+    );
+
+    return (
+      <EuiFlexGroup
+        data-test-subj="searchExceptions"
+        direction="row"
+        alignItems="center"
+        gutterSize="m"
+      >
+        <EuiFlexItem>
+          <EuiFieldSearch
+            defaultValue={defaultValue}
+            placeholder={placeholder}
+            onChange={handleOnChangeSearchField}
+            onSearch={handleOnSearchQuery}
+            isClearable
+            fullWidth
+            data-test-subj="searchField"
+          />
+        </EuiFlexItem>
+        {hasPolicyFilter && policyList ? (
+          <EuiFlexItem grow={false}>
+            <PoliciesSelector
+              policies={policyList}
+              defaultExcludedPolicies={defaultExcludedPolicies}
+              defaultIncludedPolicies={defaultIncludedPolicies}
+              onChangeSelection={onChangeSelection}
+            />
+          </EuiFlexItem>
+        ) : null}
+
+        <EuiFlexItem grow={false} onClick={handleOnSearch} data-test-subj="searchButton">
+          <EuiButton iconType="refresh">
+            {i18n.translate('xpack.securitySolution.management.search.button', {
+              defaultMessage: 'Refresh',
+            })}
+          </EuiButton>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    );
+  }
+);
+
+SearchExceptions.displayName = 'SearchExceptions';
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts
index 3219a071a0a0af..19658631e6cf2d 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts
@@ -94,7 +94,6 @@ export const endpointMiddlewareFactory: ImmutableMiddlewareFactory<EndpointState
     };
     return [indexPattern];
   }
-  // eslint-disable-next-line complexity
   return (store) => (next) => async (action) => {
     next(action);
 
@@ -108,270 +107,12 @@ export const endpointMiddlewareFactory: ImmutableMiddlewareFactory<EndpointState
       isOnEndpointPage(getState()) &&
       hasSelectedEndpoint(getState()) !== true
     ) {
-      const { page_index: pageIndex, page_size: pageSize } = uiQueryParams(getState());
-      let endpointResponse;
-
-      try {
-        const decodedQuery: Query = searchBarQuery(getState());
-
-        endpointResponse = await coreStart.http.post<HostResultList>(HOST_METADATA_LIST_ROUTE, {
-          body: JSON.stringify({
-            paging_properties: [{ page_index: pageIndex }, { page_size: pageSize }],
-            filters: { kql: decodedQuery.query },
-          }),
-        });
-        endpointResponse.request_page_index = Number(pageIndex);
-
-        dispatch({
-          type: 'serverReturnedEndpointList',
-          payload: endpointResponse,
-        });
-
-        loadEndpointsPendingActions(store);
-
-        try {
-          const endpointsTotalCount = await endpointsTotal(coreStart.http);
-          dispatch({
-            type: 'serverReturnedEndpointsTotal',
-            payload: endpointsTotalCount,
-          });
-        } catch (error) {
-          dispatch({
-            type: 'serverFailedToReturnEndpointsTotal',
-            payload: error,
-          });
-        }
-
-        try {
-          const agentsWithEndpoint = await sendGetFleetAgentsWithEndpoint(coreStart.http);
-          dispatch({
-            type: 'serverReturnedAgenstWithEndpointsTotal',
-            payload: agentsWithEndpoint.total,
-          });
-        } catch (error) {
-          dispatch({
-            type: 'serverFailedToReturnAgenstWithEndpointsTotal',
-            payload: error,
-          });
-        }
-
-        try {
-          const ingestPolicies = await getAgentAndPoliciesForEndpointsList(
-            coreStart.http,
-            endpointResponse.hosts,
-            nonExistingPolicies(getState())
-          );
-          if (ingestPolicies?.packagePolicy !== undefined) {
-            dispatch({
-              type: 'serverReturnedEndpointNonExistingPolicies',
-              payload: ingestPolicies.packagePolicy,
-            });
-          }
-          if (ingestPolicies?.agentPolicy !== undefined) {
-            dispatch({
-              type: 'serverReturnedEndpointAgentPolicies',
-              payload: ingestPolicies.agentPolicy,
-            });
-          }
-        } catch (error) {
-          // TODO should handle the error instead of logging it to the browser
-          // Also this is an anti-pattern we shouldn't use
-          // Ignore Errors, since this should not hinder the user's ability to use the UI
-          logError(error);
-        }
-      } catch (error) {
-        dispatch({
-          type: 'serverFailedToReturnEndpointList',
-          payload: error,
-        });
-      }
-
-      // get index pattern and fields for search bar
-      if (patterns(getState()).length === 0) {
-        try {
-          const indexPatterns = await fetchIndexPatterns();
-          if (indexPatterns !== undefined) {
-            dispatch({
-              type: 'serverReturnedMetadataPatterns',
-              payload: indexPatterns,
-            });
-          }
-        } catch (error) {
-          dispatch({
-            type: 'serverFailedToReturnMetadataPatterns',
-            payload: error,
-          });
-        }
-      }
-
-      // No endpoints, so we should check to see if there are policies for onboarding
-      if (endpointResponse && endpointResponse.hosts.length === 0) {
-        const http = coreStart.http;
-
-        // The original query to the list could have had an invalid param (ex. invalid page_size),
-        // so we check first if endpoints actually do exist before pulling in data for the onboarding
-        // messages.
-        if (await doEndpointsExist(http)) {
-          return;
-        }
-
-        dispatch({
-          type: 'serverReturnedEndpointExistValue',
-          payload: false,
-        });
-
-        try {
-          const policyDataResponse: GetPolicyListResponse = await sendGetEndpointSpecificPackagePolicies(
-            http,
-            {
-              query: {
-                perPage: 50, // Since this is an oboarding flow, we'll cap at 50 policies.
-                page: 1,
-              },
-            }
-          );
-
-          dispatch({
-            type: 'serverReturnedPoliciesForOnboarding',
-            payload: {
-              policyItems: policyDataResponse.items,
-            },
-          });
-        } catch (error) {
-          dispatch({
-            type: 'serverFailedToReturnPoliciesForOnboarding',
-            payload: error.body ?? error,
-          });
-          return;
-        }
-      } else {
-        dispatch({
-          type: 'serverCancelledPolicyItemsLoading',
-        });
-
-        dispatch({
-          type: 'serverReturnedEndpointExistValue',
-          payload: true,
-        });
-      }
+      endpointDetailsListMiddleware({ coreStart, store, fetchIndexPatterns });
     }
 
     // Endpoint Details
     if (action.type === 'userChangedUrl' && hasSelectedEndpoint(getState()) === true) {
-      dispatch({
-        type: 'serverCancelledPolicyItemsLoading',
-      });
-
-      // If user navigated directly to a endpoint details page, load the endpoint list
-      if (listData(getState()).length === 0) {
-        const { page_index: pageIndex, page_size: pageSize } = uiQueryParams(getState());
-        try {
-          const response = await coreStart.http.post(HOST_METADATA_LIST_ROUTE, {
-            body: JSON.stringify({
-              paging_properties: [{ page_index: pageIndex }, { page_size: pageSize }],
-            }),
-          });
-          response.request_page_index = Number(pageIndex);
-          dispatch({
-            type: 'serverReturnedEndpointList',
-            payload: response,
-          });
-
-          try {
-            const ingestPolicies = await getAgentAndPoliciesForEndpointsList(
-              coreStart.http,
-              response.hosts,
-              nonExistingPolicies(getState())
-            );
-            if (ingestPolicies?.packagePolicy !== undefined) {
-              dispatch({
-                type: 'serverReturnedEndpointNonExistingPolicies',
-                payload: ingestPolicies.packagePolicy,
-              });
-            }
-            if (ingestPolicies?.agentPolicy !== undefined) {
-              dispatch({
-                type: 'serverReturnedEndpointAgentPolicies',
-                payload: ingestPolicies.agentPolicy,
-              });
-            }
-          } catch (error) {
-            // TODO should handle the error instead of logging it to the browser
-            // Also this is an anti-pattern we shouldn't use
-            // Ignore Errors, since this should not hinder the user's ability to use the UI
-            logError(error);
-          }
-        } catch (error) {
-          dispatch({
-            type: 'serverFailedToReturnEndpointList',
-            payload: error,
-          });
-        }
-      } else {
-        dispatch({
-          type: 'serverCancelledEndpointListLoading',
-        });
-      }
-
-      // call the endpoint details api
-      const { selected_endpoint: selectedEndpoint } = uiQueryParams(getState());
-      try {
-        const response = await coreStart.http.get<HostInfo>(
-          resolvePathVariables(HOST_METADATA_GET_ROUTE, { id: selectedEndpoint as string })
-        );
-        dispatch({
-          type: 'serverReturnedEndpointDetails',
-          payload: response,
-        });
-
-        try {
-          const ingestPolicies = await getAgentAndPoliciesForEndpointsList(
-            coreStart.http,
-            [response],
-            nonExistingPolicies(getState())
-          );
-          if (ingestPolicies !== undefined) {
-            dispatch({
-              type: 'serverReturnedEndpointNonExistingPolicies',
-              payload: ingestPolicies.packagePolicy,
-            });
-          }
-          if (ingestPolicies?.agentPolicy !== undefined) {
-            dispatch({
-              type: 'serverReturnedEndpointAgentPolicies',
-              payload: ingestPolicies.agentPolicy,
-            });
-          }
-        } catch (error) {
-          // TODO should handle the error instead of logging it to the browser
-          // Also this is an anti-pattern we shouldn't use
-          // Ignore Errors, since this should not hinder the user's ability to use the UI
-          logError(error);
-        }
-      } catch (error) {
-        dispatch({
-          type: 'serverFailedToReturnEndpointDetails',
-          payload: error,
-        });
-      }
-
-      loadEndpointsPendingActions(store);
-
-      // call the policy response api
-      try {
-        const policyResponse = await coreStart.http.get(BASE_POLICY_RESPONSE_ROUTE, {
-          query: { agentId: selectedEndpoint },
-        });
-        dispatch({
-          type: 'serverReturnedEndpointPolicyResponse',
-          payload: policyResponse,
-        });
-      } catch (error) {
-        dispatch({
-          type: 'serverFailedToReturnEndpointPolicyResponse',
-          payload: error,
-        });
-      }
+      endpointDetailsMiddleware({ store, coreStart });
     }
 
     if (
@@ -379,32 +120,7 @@ export const endpointMiddlewareFactory: ImmutableMiddlewareFactory<EndpointState
       hasSelectedEndpoint(getState()) === true &&
       getIsOnEndpointDetailsActivityLog(getState())
     ) {
-      // call the activity log api
-      dispatch({
-        type: 'endpointDetailsActivityLogChanged',
-        // ts error to be fixed when AsyncResourceState is refactored (#830)
-        // @ts-expect-error
-        payload: createLoadingResourceState<ActivityLog>(getActivityLogData(getState())),
-      });
-
-      try {
-        const { page, pageSize } = getActivityLogDataPaging(getState());
-        const route = resolvePathVariables(ENDPOINT_ACTION_LOG_ROUTE, {
-          agent_id: selectedAgent(getState()),
-        });
-        const activityLog = await coreStart.http.get<ActivityLog>(route, {
-          query: { page, page_size: pageSize },
-        });
-        dispatch({
-          type: 'endpointDetailsActivityLogChanged',
-          payload: createLoadedResourceState<ActivityLog>(activityLog),
-        });
-      } catch (error) {
-        dispatch({
-          type: 'endpointDetailsActivityLogChanged',
-          payload: createFailedResourceState<ActivityLog>(error.body ?? error),
-        });
-      }
+      endpointDetailsActivityLogChangedMiddleware({ store, coreStart });
     }
 
     // page activity log API
@@ -412,91 +128,7 @@ export const endpointMiddlewareFactory: ImmutableMiddlewareFactory<EndpointState
       action.type === 'endpointDetailsActivityLogUpdatePaging' &&
       hasSelectedEndpoint(getState())
     ) {
-      try {
-        const { disabled, page, pageSize, startDate, endDate } = getActivityLogDataPaging(
-          getState()
-        );
-        // don't page when paging is disabled or when date ranges are invalid
-        if (disabled) {
-          return;
-        }
-        if (getIsInvalidDateRange({ startDate, endDate })) {
-          dispatch({
-            type: 'endpointDetailsActivityLogUpdateIsInvalidDateRange',
-            payload: {
-              isInvalidDateRange: true,
-            },
-          });
-          return;
-        }
-
-        dispatch({
-          type: 'endpointDetailsActivityLogUpdateIsInvalidDateRange',
-          payload: {
-            isInvalidDateRange: false,
-          },
-        });
-        dispatch({
-          type: 'endpointDetailsActivityLogChanged',
-          // ts error to be fixed when AsyncResourceState is refactored (#830)
-          // @ts-expect-error
-          payload: createLoadingResourceState<ActivityLog>(getActivityLogData(getState())),
-        });
-        const route = resolvePathVariables(ENDPOINT_ACTION_LOG_ROUTE, {
-          agent_id: selectedAgent(getState()),
-        });
-        const activityLog = await coreStart.http.get<ActivityLog>(route, {
-          query: {
-            page,
-            page_size: pageSize,
-            start_date: startDate,
-            end_date: endDate,
-          },
-        });
-
-        const lastLoadedLogData = getLastLoadedActivityLogData(getState());
-        if (lastLoadedLogData !== undefined) {
-          const updatedLogDataItems = ([
-            ...new Set([...lastLoadedLogData.data, ...activityLog.data]),
-          ] as ActivityLog['data']).sort((a, b) =>
-            new Date(b.item.data['@timestamp']) > new Date(a.item.data['@timestamp']) ? 1 : -1
-          );
-
-          const updatedLogData = {
-            page: activityLog.page,
-            pageSize: activityLog.pageSize,
-            startDate: activityLog.startDate,
-            endDate: activityLog.endDate,
-            data: activityLog.page === 1 ? activityLog.data : updatedLogDataItems,
-          };
-          dispatch({
-            type: 'endpointDetailsActivityLogChanged',
-            payload: createLoadedResourceState<ActivityLog>(updatedLogData),
-          });
-          if (!activityLog.data.length) {
-            dispatch({
-              type: 'endpointDetailsActivityLogUpdatePaging',
-              payload: {
-                disabled: true,
-                page: activityLog.page > 1 ? activityLog.page - 1 : 1,
-                pageSize: activityLog.pageSize,
-                startDate: activityLog.startDate,
-                endDate: activityLog.endDate,
-              },
-            });
-          }
-        } else {
-          dispatch({
-            type: 'endpointDetailsActivityLogChanged',
-            payload: createLoadedResourceState<ActivityLog>(activityLog),
-          });
-        }
-      } catch (error) {
-        dispatch({
-          type: 'endpointDetailsActivityLogChanged',
-          payload: createFailedResourceState<ActivityLog>(error.body ?? error),
-        });
-      }
+      endpointDetailsActivityLogPagingMiddleware({ store, coreStart });
     }
 
     // Isolate Host
@@ -730,6 +362,416 @@ const loadEndpointsPendingActions = async ({
   }
 };
 
+async function endpointDetailsListMiddleware({
+  store,
+  coreStart,
+  fetchIndexPatterns,
+}: {
+  store: ImmutableMiddlewareAPI<EndpointState, AppAction>;
+  coreStart: CoreStart;
+  fetchIndexPatterns: () => Promise<IIndexPattern[]>;
+}) {
+  const { getState, dispatch } = store;
+
+  const { page_index: pageIndex, page_size: pageSize } = uiQueryParams(getState());
+  let endpointResponse;
+
+  try {
+    const decodedQuery: Query = searchBarQuery(getState());
+
+    endpointResponse = await coreStart.http.post<HostResultList>(HOST_METADATA_LIST_ROUTE, {
+      body: JSON.stringify({
+        paging_properties: [{ page_index: pageIndex }, { page_size: pageSize }],
+        filters: { kql: decodedQuery.query },
+      }),
+    });
+    endpointResponse.request_page_index = Number(pageIndex);
+
+    dispatch({
+      type: 'serverReturnedEndpointList',
+      payload: endpointResponse,
+    });
+
+    loadEndpointsPendingActions(store);
+
+    try {
+      const endpointsTotalCount = await endpointsTotal(coreStart.http);
+      dispatch({
+        type: 'serverReturnedEndpointsTotal',
+        payload: endpointsTotalCount,
+      });
+    } catch (error) {
+      dispatch({
+        type: 'serverFailedToReturnEndpointsTotal',
+        payload: error,
+      });
+    }
+
+    try {
+      const agentsWithEndpoint = await sendGetFleetAgentsWithEndpoint(coreStart.http);
+      dispatch({
+        type: 'serverReturnedAgenstWithEndpointsTotal',
+        payload: agentsWithEndpoint.total,
+      });
+    } catch (error) {
+      dispatch({
+        type: 'serverFailedToReturnAgenstWithEndpointsTotal',
+        payload: error,
+      });
+    }
+
+    try {
+      const ingestPolicies = await getAgentAndPoliciesForEndpointsList(
+        coreStart.http,
+        endpointResponse.hosts,
+        nonExistingPolicies(getState())
+      );
+      if (ingestPolicies?.packagePolicy !== undefined) {
+        dispatch({
+          type: 'serverReturnedEndpointNonExistingPolicies',
+          payload: ingestPolicies.packagePolicy,
+        });
+      }
+      if (ingestPolicies?.agentPolicy !== undefined) {
+        dispatch({
+          type: 'serverReturnedEndpointAgentPolicies',
+          payload: ingestPolicies.agentPolicy,
+        });
+      }
+    } catch (error) {
+      // TODO should handle the error instead of logging it to the browser
+      // Also this is an anti-pattern we shouldn't use
+      // Ignore Errors, since this should not hinder the user's ability to use the UI
+      logError(error);
+    }
+  } catch (error) {
+    dispatch({
+      type: 'serverFailedToReturnEndpointList',
+      payload: error,
+    });
+  }
+
+  // get index pattern and fields for search bar
+  if (patterns(getState()).length === 0) {
+    try {
+      const indexPatterns = await fetchIndexPatterns();
+      if (indexPatterns !== undefined) {
+        dispatch({
+          type: 'serverReturnedMetadataPatterns',
+          payload: indexPatterns,
+        });
+      }
+    } catch (error) {
+      dispatch({
+        type: 'serverFailedToReturnMetadataPatterns',
+        payload: error,
+      });
+    }
+  }
+
+  // No endpoints, so we should check to see if there are policies for onboarding
+  if (endpointResponse && endpointResponse.hosts.length === 0) {
+    const http = coreStart.http;
+
+    // The original query to the list could have had an invalid param (ex. invalid page_size),
+    // so we check first if endpoints actually do exist before pulling in data for the onboarding
+    // messages.
+    if (await doEndpointsExist(http)) {
+      return;
+    }
+
+    dispatch({
+      type: 'serverReturnedEndpointExistValue',
+      payload: false,
+    });
+
+    try {
+      const policyDataResponse: GetPolicyListResponse = await sendGetEndpointSpecificPackagePolicies(
+        http,
+        {
+          query: {
+            perPage: 50, // Since this is an oboarding flow, we'll cap at 50 policies.
+            page: 1,
+          },
+        }
+      );
+
+      dispatch({
+        type: 'serverReturnedPoliciesForOnboarding',
+        payload: {
+          policyItems: policyDataResponse.items,
+        },
+      });
+    } catch (error) {
+      dispatch({
+        type: 'serverFailedToReturnPoliciesForOnboarding',
+        payload: error.body ?? error,
+      });
+    }
+  } else {
+    dispatch({
+      type: 'serverCancelledPolicyItemsLoading',
+    });
+
+    dispatch({
+      type: 'serverReturnedEndpointExistValue',
+      payload: true,
+    });
+  }
+}
+
+async function endpointDetailsActivityLogPagingMiddleware({
+  store,
+  coreStart,
+}: {
+  store: ImmutableMiddlewareAPI<EndpointState, AppAction>;
+  coreStart: CoreStart;
+}) {
+  const { getState, dispatch } = store;
+  try {
+    const { disabled, page, pageSize, startDate, endDate } = getActivityLogDataPaging(getState());
+    // don't page when paging is disabled or when date ranges are invalid
+    if (disabled) {
+      return;
+    }
+    if (getIsInvalidDateRange({ startDate, endDate })) {
+      dispatch({
+        type: 'endpointDetailsActivityLogUpdateIsInvalidDateRange',
+        payload: {
+          isInvalidDateRange: true,
+        },
+      });
+      return;
+    }
+
+    dispatch({
+      type: 'endpointDetailsActivityLogUpdateIsInvalidDateRange',
+      payload: {
+        isInvalidDateRange: false,
+      },
+    });
+    dispatch({
+      type: 'endpointDetailsActivityLogChanged',
+      // ts error to be fixed when AsyncResourceState is refactored (#830)
+      // @ts-expect-error
+      payload: createLoadingResourceState<ActivityLog>(getActivityLogData(getState())),
+    });
+    const route = resolvePathVariables(ENDPOINT_ACTION_LOG_ROUTE, {
+      agent_id: selectedAgent(getState()),
+    });
+    const activityLog = await coreStart.http.get<ActivityLog>(route, {
+      query: {
+        page,
+        page_size: pageSize,
+        start_date: startDate,
+        end_date: endDate,
+      },
+    });
+
+    const lastLoadedLogData = getLastLoadedActivityLogData(getState());
+    if (lastLoadedLogData !== undefined) {
+      const updatedLogDataItems = ([
+        ...new Set([...lastLoadedLogData.data, ...activityLog.data]),
+      ] as ActivityLog['data']).sort((a, b) =>
+        new Date(b.item.data['@timestamp']) > new Date(a.item.data['@timestamp']) ? 1 : -1
+      );
+
+      const updatedLogData = {
+        page: activityLog.page,
+        pageSize: activityLog.pageSize,
+        startDate: activityLog.startDate,
+        endDate: activityLog.endDate,
+        data: activityLog.page === 1 ? activityLog.data : updatedLogDataItems,
+      };
+      dispatch({
+        type: 'endpointDetailsActivityLogChanged',
+        payload: createLoadedResourceState<ActivityLog>(updatedLogData),
+      });
+      if (!activityLog.data.length) {
+        dispatch({
+          type: 'endpointDetailsActivityLogUpdatePaging',
+          payload: {
+            disabled: true,
+            page: activityLog.page > 1 ? activityLog.page - 1 : 1,
+            pageSize: activityLog.pageSize,
+            startDate: activityLog.startDate,
+            endDate: activityLog.endDate,
+          },
+        });
+      }
+    } else {
+      dispatch({
+        type: 'endpointDetailsActivityLogChanged',
+        payload: createLoadedResourceState<ActivityLog>(activityLog),
+      });
+    }
+  } catch (error) {
+    dispatch({
+      type: 'endpointDetailsActivityLogChanged',
+      payload: createFailedResourceState<ActivityLog>(error.body ?? error),
+    });
+  }
+}
+
+async function endpointDetailsMiddleware({
+  store,
+  coreStart,
+}: {
+  store: ImmutableMiddlewareAPI<EndpointState, AppAction>;
+  coreStart: CoreStart;
+}) {
+  const { getState, dispatch } = store;
+  dispatch({
+    type: 'serverCancelledPolicyItemsLoading',
+  });
+
+  // If user navigated directly to a endpoint details page, load the endpoint list
+  if (listData(getState()).length === 0) {
+    const { page_index: pageIndex, page_size: pageSize } = uiQueryParams(getState());
+    try {
+      const response = await coreStart.http.post(HOST_METADATA_LIST_ROUTE, {
+        body: JSON.stringify({
+          paging_properties: [{ page_index: pageIndex }, { page_size: pageSize }],
+        }),
+      });
+      response.request_page_index = Number(pageIndex);
+      dispatch({
+        type: 'serverReturnedEndpointList',
+        payload: response,
+      });
+
+      try {
+        const ingestPolicies = await getAgentAndPoliciesForEndpointsList(
+          coreStart.http,
+          response.hosts,
+          nonExistingPolicies(getState())
+        );
+        if (ingestPolicies?.packagePolicy !== undefined) {
+          dispatch({
+            type: 'serverReturnedEndpointNonExistingPolicies',
+            payload: ingestPolicies.packagePolicy,
+          });
+        }
+        if (ingestPolicies?.agentPolicy !== undefined) {
+          dispatch({
+            type: 'serverReturnedEndpointAgentPolicies',
+            payload: ingestPolicies.agentPolicy,
+          });
+        }
+      } catch (error) {
+        // TODO should handle the error instead of logging it to the browser
+        // Also this is an anti-pattern we shouldn't use
+        // Ignore Errors, since this should not hinder the user's ability to use the UI
+        logError(error);
+      }
+    } catch (error) {
+      dispatch({
+        type: 'serverFailedToReturnEndpointList',
+        payload: error,
+      });
+    }
+  } else {
+    dispatch({
+      type: 'serverCancelledEndpointListLoading',
+    });
+  }
+
+  // call the endpoint details api
+  const { selected_endpoint: selectedEndpoint } = uiQueryParams(getState());
+  try {
+    const response = await coreStart.http.get<HostInfo>(
+      resolvePathVariables(HOST_METADATA_GET_ROUTE, { id: selectedEndpoint as string })
+    );
+    dispatch({
+      type: 'serverReturnedEndpointDetails',
+      payload: response,
+    });
+
+    try {
+      const ingestPolicies = await getAgentAndPoliciesForEndpointsList(
+        coreStart.http,
+        [response],
+        nonExistingPolicies(getState())
+      );
+      if (ingestPolicies !== undefined) {
+        dispatch({
+          type: 'serverReturnedEndpointNonExistingPolicies',
+          payload: ingestPolicies.packagePolicy,
+        });
+      }
+      if (ingestPolicies?.agentPolicy !== undefined) {
+        dispatch({
+          type: 'serverReturnedEndpointAgentPolicies',
+          payload: ingestPolicies.agentPolicy,
+        });
+      }
+    } catch (error) {
+      // TODO should handle the error instead of logging it to the browser
+      // Also this is an anti-pattern we shouldn't use
+      // Ignore Errors, since this should not hinder the user's ability to use the UI
+      logError(error);
+    }
+  } catch (error) {
+    dispatch({
+      type: 'serverFailedToReturnEndpointDetails',
+      payload: error,
+    });
+  }
+
+  loadEndpointsPendingActions(store);
+
+  // call the policy response api
+  try {
+    const policyResponse = await coreStart.http.get(BASE_POLICY_RESPONSE_ROUTE, {
+      query: { agentId: selectedEndpoint },
+    });
+    dispatch({
+      type: 'serverReturnedEndpointPolicyResponse',
+      payload: policyResponse,
+    });
+  } catch (error) {
+    dispatch({
+      type: 'serverFailedToReturnEndpointPolicyResponse',
+      payload: error,
+    });
+  }
+}
+async function endpointDetailsActivityLogChangedMiddleware({
+  store,
+  coreStart,
+}: {
+  store: ImmutableMiddlewareAPI<EndpointState, AppAction>;
+  coreStart: CoreStart;
+}) {
+  const { getState, dispatch } = store;
+  // call the activity log api
+  dispatch({
+    type: 'endpointDetailsActivityLogChanged',
+    // ts error to be fixed when AsyncResourceState is refactored (#830)
+    // @ts-expect-error
+    payload: createLoadingResourceState<ActivityLog>(getActivityLogData(getState())),
+  });
+
+  try {
+    const { page, pageSize } = getActivityLogDataPaging(getState());
+    const route = resolvePathVariables(ENDPOINT_ACTION_LOG_ROUTE, {
+      agent_id: selectedAgent(getState()),
+    });
+    const activityLog = await coreStart.http.get<ActivityLog>(route, {
+      query: { page, page_size: pageSize },
+    });
+    dispatch({
+      type: 'endpointDetailsActivityLogChanged',
+      payload: createLoadedResourceState<ActivityLog>(activityLog),
+    });
+  } catch (error) {
+    dispatch({
+      type: 'endpointDetailsActivityLogChanged',
+      payload: createFailedResourceState<ActivityLog>(error.body ?? error),
+    });
+  }
+}
+
 export async function handleLoadMetadataTransformStats(http: HttpStart, store: EndpointPageStore) {
   const { getState, dispatch } = store;
 
diff --git a/x-pack/plugins/security_solution/public/management/pages/event_filters/view/components/form/index.test.tsx b/x-pack/plugins/security_solution/public/management/pages/event_filters/view/components/form/index.test.tsx
index 4171441e7de254..dab6f8108b6f1f 100644
--- a/x-pack/plugins/security_solution/public/management/pages/event_filters/view/components/form/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/event_filters/view/components/form/index.test.tsx
@@ -6,56 +6,48 @@
  */
 import React from 'react';
 import { EventFiltersForm } from '.';
-import { RenderResult, act, render } from '@testing-library/react';
-import { fireEvent } from '@testing-library/dom';
+import { RenderResult, act } from '@testing-library/react';
+import { fireEvent, waitFor } from '@testing-library/dom';
 import { stubIndexPatternWithFields } from 'src/plugins/data/common/index_patterns/index_pattern.stub';
 import { getInitialExceptionFromEvent } from '../../../store/utils';
-import { Provider } from 'react-redux';
 import { useFetchIndex } from '../../../../../../common/containers/source';
-import { ThemeProvider } from 'styled-components';
-import { createGlobalNoMiddlewareStore, ecsEventMock } from '../../../test_utils';
-import { getMockTheme } from '../../../../../../common/lib/kibana/kibana_react.mock';
+import { ecsEventMock } from '../../../test_utils';
 import { NAME_ERROR, NAME_PLACEHOLDER } from './translations';
 import { useCurrentUser, useKibana } from '../../../../../../common/lib/kibana';
-import { ExceptionBuilder } from '../../../../../../shared_imports';
+import {
+  AppContextTestRender,
+  createAppRootMockRenderer,
+} from '../../../../../../common/mock/endpoint';
+import { EventFiltersListPageState } from '../../../types';
 
 jest.mock('../../../../../../common/lib/kibana');
 jest.mock('../../../../../../common/containers/source');
 
-const mockTheme = getMockTheme({
-  eui: {
-    paddingSizes: { m: '2' },
-  },
-});
-
 describe('Event filter form', () => {
   let component: RenderResult;
-  let store: ReturnType<typeof createGlobalNoMiddlewareStore>;
-
-  const renderForm = () => {
-    const Wrapper: React.FC = ({ children }) => (
-      <Provider store={store}>
-        <ThemeProvider theme={mockTheme}>{children}</ThemeProvider>
-      </Provider>
-    );
-
-    return render(<EventFiltersForm />, { wrapper: Wrapper });
-  };
-
-  const renderComponentWithdata = () => {
-    const entry = getInitialExceptionFromEvent(ecsEventMock());
-    act(() => {
-      store.dispatch({
-        type: 'eventFiltersInitForm',
-        payload: { entry },
-      });
-    });
-    return renderForm();
-  };
+  let mockedContext: AppContextTestRender;
+  let render: () => ReturnType<AppContextTestRender['render']>;
+  let renderWithData: () => Promise<ReturnType<AppContextTestRender['render']>>;
+  let getState: () => EventFiltersListPageState;
 
   beforeEach(() => {
-    const emptyComp = <span data-test-subj="alert-exception-builder" />;
-    jest.spyOn(ExceptionBuilder, 'getExceptionBuilderComponentLazy').mockReturnValue(emptyComp);
+    mockedContext = createAppRootMockRenderer();
+    getState = () => mockedContext.store.getState().management.eventFilters;
+    render = () => mockedContext.render(<EventFiltersForm />);
+    renderWithData = async () => {
+      const renderResult = render();
+      const entry = getInitialExceptionFromEvent(ecsEventMock());
+      act(() => {
+        mockedContext.store.dispatch({
+          type: 'eventFiltersInitForm',
+          payload: { entry },
+        });
+      });
+      await waitFor(() => {
+        expect(renderResult.getByTestId('exceptionsBuilderWrapper')).toBeInTheDocument();
+      });
+      return renderResult;
+    };
 
     (useFetchIndex as jest.Mock).mockImplementation(() => [
       false,
@@ -71,21 +63,21 @@ describe('Event filter form', () => {
         notifications: {},
       },
     });
-    store = createGlobalNoMiddlewareStore();
   });
+
   it('should renders correctly without data', () => {
-    component = renderForm();
+    component = render();
     expect(component.getByTestId('loading-spinner')).not.toBeNull();
   });
 
-  it('should renders correctly with data', () => {
-    component = renderComponentWithdata();
+  it('should renders correctly with data', async () => {
+    component = await renderWithData();
 
-    expect(component.getByTestId('alert-exception-builder')).not.toBeNull();
+    expect(component.getByTestId('exceptionsBuilderWrapper')).not.toBeNull();
   });
 
-  it('should display name error only when on blur and empty name', () => {
-    component = renderComponentWithdata();
+  it('should display name error only when on blur and empty name', async () => {
+    component = await renderWithData();
     expect(component.queryByText(NAME_ERROR)).toBeNull();
     const nameInput = component.getByPlaceholderText(NAME_PLACEHOLDER);
     act(() => {
@@ -95,7 +87,7 @@ describe('Event filter form', () => {
   });
 
   it('should change name', async () => {
-    component = renderComponentWithdata();
+    component = await renderWithData();
 
     const nameInput = component.getByPlaceholderText(NAME_PLACEHOLDER);
 
@@ -107,12 +99,12 @@ describe('Event filter form', () => {
       });
     });
 
-    expect(store.getState()!.management!.eventFilters!.form!.entry!.name).toBe('Exception name');
-    expect(store.getState()!.management!.eventFilters!.form!.hasNameError).toBeFalsy();
+    expect(getState().form.entry!.name).toBe('Exception name');
+    expect(getState().form.hasNameError).toBeFalsy();
   });
 
   it('should change name with a white space still shows an error', async () => {
-    component = renderComponentWithdata();
+    component = await renderWithData();
 
     const nameInput = component.getByPlaceholderText(NAME_PLACEHOLDER);
 
@@ -124,12 +116,12 @@ describe('Event filter form', () => {
       });
     });
 
-    expect(store.getState()!.management!.eventFilters!.form!.entry!.name).toBe('');
-    expect(store.getState()!.management!.eventFilters!.form!.hasNameError).toBeTruthy();
+    expect(getState().form.entry!.name).toBe('');
+    expect(getState().form.hasNameError).toBeTruthy();
   });
 
   it('should change comments', async () => {
-    component = renderComponentWithdata();
+    component = await renderWithData();
 
     const commentInput = component.getByPlaceholderText('Add a new comment...');
 
@@ -141,6 +133,6 @@ describe('Event filter form', () => {
       });
     });
 
-    expect(store.getState()!.management!.eventFilters!.form!.newComment).toBe('Exception comment');
+    expect(getState().form.newComment).toBe('Exception comment');
   });
 });
diff --git a/x-pack/plugins/security_solution/public/management/pages/event_filters/view/event_filters_list_page.tsx b/x-pack/plugins/security_solution/public/management/pages/event_filters/view/event_filters_list_page.tsx
index 95f3e856a6ff6d..3c537320bc92af 100644
--- a/x-pack/plugins/security_solution/public/management/pages/event_filters/view/event_filters_list_page.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/event_filters/view/event_filters_list_page.tsx
@@ -42,7 +42,7 @@ import {
 } from '../../../../common/components/exceptions/viewer/exception_item';
 import { EventFilterDeleteModal } from './components/event_filter_delete_modal';
 
-import { SearchBar } from '../../../components/search_bar';
+import { SearchExceptions } from '../../../components/search_exceptions';
 import { BackToExternalAppButton } from '../../../components/back_to_external_app_button';
 import { ABOUT_EVENT_FILTERS } from './translations';
 
@@ -226,7 +226,7 @@ export const EventFiltersListPage = memo(() => {
 
       {doesDataExist && (
         <>
-          <SearchBar
+          <SearchExceptions
             defaultValue={location.filter}
             onSearch={handleOnSearch}
             placeholder={i18n.translate('xpack.securitySolution.eventFilter.search.placeholder', {
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/index.test.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/index.test.ts
index 803fa9ee6759f4..4ef7adf4d94256 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/index.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/index.test.ts
@@ -313,11 +313,16 @@ describe('policy details: ', () => {
                   mac: {
                     events: { process: true, file: true, network: true },
                     malware: { mode: 'prevent' },
+                    behavior_protection: { mode: 'off', supported: false },
                     popup: {
                       malware: {
                         enabled: true,
                         message: '',
                       },
+                      behavior_protection: {
+                        enabled: false,
+                        message: '',
+                      },
                     },
                     logging: { file: 'info' },
                   },
@@ -325,11 +330,16 @@ describe('policy details: ', () => {
                     events: { process: true, file: true, network: true },
                     logging: { file: 'info' },
                     malware: { mode: 'prevent' },
+                    behavior_protection: { mode: 'off', supported: false },
                     popup: {
                       malware: {
                         enabled: true,
                         message: '',
                       },
+                      behavior_protection: {
+                        enabled: false,
+                        message: '',
+                      },
                     },
                   },
                 },
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware.ts
index 6185d7d3c446b9..9e6bc4b0097f36 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware.ts
@@ -56,6 +56,14 @@ export const policyDetailsMiddlewareFactory: ImmutableMiddlewareFactory<PolicyDe
         ) {
           policyItem.inputs[0].config.policy.value.windows.popup.behavior_protection.message = DefaultPolicyNotificationMessage;
         }
+        if (policyItem.inputs[0].config.policy.value.mac.popup.behavior_protection.message === '') {
+          policyItem.inputs[0].config.policy.value.mac.popup.behavior_protection.message = DefaultPolicyNotificationMessage;
+        }
+        if (
+          policyItem.inputs[0].config.policy.value.linux.popup.behavior_protection.message === ''
+        ) {
+          policyItem.inputs[0].config.policy.value.linux.popup.behavior_protection.message = DefaultPolicyNotificationMessage;
+        }
       } catch (error) {
         dispatch({
           type: 'serverFailedToReturnPolicyDetailsData',
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors.ts
index 5391951785a02c..9991124dc5e43e 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors.ts
@@ -194,12 +194,14 @@ export const policyConfig: (s: PolicyDetailsState) => UIPolicyConfig = createSel
         advanced: mac.advanced,
         events: mac.events,
         malware: mac.malware,
+        behavior_protection: mac.behavior_protection,
         popup: mac.popup,
       },
       linux: {
         advanced: linux.advanced,
         events: linux.events,
         malware: linux.malware,
+        behavior_protection: linux.behavior_protection,
         popup: linux.popup,
       },
     };
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/types.ts b/x-pack/plugins/security_solution/public/management/pages/policy/types.ts
index e3c4476d9fc8c6..7d296c2ea0ae08 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/types.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/types.ts
@@ -137,8 +137,8 @@ export type PolicyProtection =
       UIPolicyConfig['windows'],
       'malware' | 'ransomware' | 'memory_protection' | 'behavior_protection'
     >
-  | keyof Pick<UIPolicyConfig['mac'], 'malware'>
-  | keyof Pick<UIPolicyConfig['linux'], 'malware'>;
+  | keyof Pick<UIPolicyConfig['mac'], 'malware' | 'behavior_protection'>
+  | keyof Pick<UIPolicyConfig['linux'], 'malware' | 'behavior_protection'>;
 
 export type MacPolicyProtection = keyof Pick<UIPolicyConfig['mac'], 'malware'>;
 
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_forms/protections/behavior.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_forms/protections/behavior.tsx
index d94adb47571233..60552ca4d4ff99 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_forms/protections/behavior.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_forms/protections/behavior.tsx
@@ -23,14 +23,14 @@ import { SecurityPageName } from '../../../../../../app/types';
  *  which will configure for all relevant OSes.
  */
 export const BehaviorProtection = React.memo(() => {
-  const OSes: Immutable<BehaviorProtectionOSes[]> = [OS.windows];
+  const OSes: Immutable<BehaviorProtectionOSes[]> = [OS.windows, OS.mac, OS.linux];
   const protection = 'behavior_protection';
   return (
     <ConfigForm
       type={i18n.translate('xpack.securitySolution.endpoint.policy.details.behavior_protection', {
         defaultMessage: 'Behavior Protection',
       })}
-      supportedOss={[OperatingSystem.WINDOWS]}
+      supportedOss={[OperatingSystem.WINDOWS, OperatingSystem.MAC, OperatingSystem.LINUX]}
       dataTestSubj="behaviorProtectionsForm"
       rightCorner={<ProtectionSwitch protection={protection} osList={OSes} />}
     >
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/state/trusted_apps_list_page_state.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/state/trusted_apps_list_page_state.ts
index be27ccd7eed1ff..0dc82ef554d1c7 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/state/trusted_apps_list_page_state.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/state/trusted_apps_list_page_state.ts
@@ -23,6 +23,8 @@ export interface TrustedAppsListData {
   timestamp: number;
   totalItemsCount: number;
   filter: string;
+  includedPolicies: string;
+  excludedPolicies: string;
 }
 
 export type ViewType = 'list' | 'grid';
@@ -35,6 +37,10 @@ export interface TrustedAppsListPageLocation {
   /** Used for editing. The ID of the selected trusted app */
   id?: string;
   filter: string;
+  // A string with comma dlimetered list of included policy IDs
+  included_policies: string;
+  // A string with comma dlimetered list of excluded policy IDs
+  excluded_policies: string;
 }
 
 export interface TrustedAppsListPageState {
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/builders.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/builders.ts
index 988d3d6e828cc5..8b1272be605be8 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/builders.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/builders.ts
@@ -57,6 +57,8 @@ export const initialTrustedAppsPageState = (): TrustedAppsListPageState => ({
     id: undefined,
     view_type: 'grid',
     filter: '',
+    included_policies: '',
+    excluded_policies: '',
   },
   active: false,
   forceRefresh: false,
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.test.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.test.ts
index 9624987c8af567..f64003ec6ad910 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.test.ts
@@ -26,6 +26,7 @@ import { initialTrustedAppsPageState } from './builders';
 import { trustedAppsPageReducer } from './reducer';
 import { createTrustedAppsPageMiddleware } from './middleware';
 import { Immutable } from '../../../../../common/endpoint/types';
+import { getGeneratedPolicyResponse } from './mocks';
 
 const initialNow = 111111;
 const dateNowMock = jest.fn();
@@ -189,8 +190,10 @@ describe('middleware', () => {
       const location = createLocationState();
       const service = createTrustedAppsServiceMock();
       const { store, spyMiddleware } = createStoreSetup(service);
+      const policiesResponse = getGeneratedPolicyResponse();
 
       service.getTrustedAppsList.mockResolvedValue(createGetTrustedListAppsResponse(pagination));
+      service.getPolicyList.mockResolvedValue(policiesResponse);
 
       store.dispatch(createUserChangedUrlAction('/administration/trusted_apps'));
 
@@ -215,10 +218,15 @@ describe('middleware', () => {
       });
 
       await spyMiddleware.waitForAction('trustedAppsListResourceStateChanged');
+      await spyMiddleware.waitForAction('trustedAppsPoliciesStateChanged');
 
       expect(store.getState()).toStrictEqual({
         ...initialState,
         ...entriesExistLoadedState(),
+        policies: {
+          data: policiesResponse,
+          type: 'LoadedResourceState',
+        },
         listView: createLoadedListViewWithPagination(newNow, pagination),
         active: true,
         location,
@@ -304,9 +312,11 @@ describe('middleware', () => {
     it('submits successfully when entry is defined', async () => {
       const service = createTrustedAppsServiceMock();
       const { store, spyMiddleware } = createStoreSetup(service);
+      const policiesResponse = getGeneratedPolicyResponse();
 
       service.getTrustedAppsList.mockResolvedValue(getTrustedAppsListResponse);
       service.deleteTrustedApp.mockResolvedValue();
+      service.getPolicyList.mockResolvedValue(policiesResponse);
 
       store.dispatch(createUserChangedUrlAction('/administration/trusted_apps'));
 
@@ -335,6 +345,10 @@ describe('middleware', () => {
       expect(store.getState()).toStrictEqual({
         ...testStartState,
         ...entriesExistLoadedState(),
+        policies: {
+          data: policiesResponse,
+          type: 'LoadedResourceState',
+        },
         listView: listViewNew,
       });
       expect(service.deleteTrustedApp).toBeCalledWith({ id: '3' });
@@ -344,9 +358,11 @@ describe('middleware', () => {
     it('does not submit twice', async () => {
       const service = createTrustedAppsServiceMock();
       const { store, spyMiddleware } = createStoreSetup(service);
+      const policiesResponse = getGeneratedPolicyResponse();
 
       service.getTrustedAppsList.mockResolvedValue(getTrustedAppsListResponse);
       service.deleteTrustedApp.mockResolvedValue();
+      service.getPolicyList.mockResolvedValue(policiesResponse);
 
       store.dispatch(createUserChangedUrlAction('/administration/trusted_apps'));
 
@@ -376,6 +392,10 @@ describe('middleware', () => {
       expect(store.getState()).toStrictEqual({
         ...testStartState,
         ...entriesExistLoadedState(),
+        policies: {
+          data: policiesResponse,
+          type: 'LoadedResourceState',
+        },
         listView: listViewNew,
       });
       expect(service.deleteTrustedApp).toBeCalledWith({ id: '3' });
@@ -385,9 +405,11 @@ describe('middleware', () => {
     it('does not submit when server response with failure', async () => {
       const service = createTrustedAppsServiceMock();
       const { store, spyMiddleware } = createStoreSetup(service);
+      const policiesResponse = getGeneratedPolicyResponse();
 
       service.getTrustedAppsList.mockResolvedValue(getTrustedAppsListResponse);
       service.deleteTrustedApp.mockRejectedValue({ body: notFoundError });
+      service.getPolicyList.mockResolvedValue(policiesResponse);
 
       store.dispatch(createUserChangedUrlAction('/administration/trusted_apps'));
 
@@ -409,10 +431,15 @@ describe('middleware', () => {
       });
 
       await spyMiddleware.waitForAction('trustedAppDeletionSubmissionResourceStateChanged');
+      await spyMiddleware.waitForAction('trustedAppsPoliciesStateChanged');
 
       expect(store.getState()).toStrictEqual({
         ...testStartState,
         ...entriesExistLoadedState(),
+        policies: {
+          data: policiesResponse,
+          type: 'LoadedResourceState',
+        },
         deletionDialog: {
           entry,
           confirmed: true,
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.ts
index da6394a9ab8969..cf7cff30d6d6d1 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/middleware.ts
@@ -26,6 +26,7 @@ import {
   isLoadedResourceState,
   isLoadingResourceState,
   isStaleResourceState,
+  isUninitialisedResourceState,
   StaleResourceState,
   TrustedAppsListData,
   TrustedAppsListPageState,
@@ -63,8 +64,10 @@ import {
   editingTrustedApp,
   getListItems,
   editItemState,
+  getCurrentLocationIncludedPolicies,
+  getCurrentLocationExcludedPolicies,
 } from './selectors';
-import { parseQueryFilterToKQL } from '../../../common/utils';
+import { parsePoliciesToKQL, parseQueryFilterToKQL } from '../../../common/utils';
 import { toUpdateTrustedApp } from '../../../../../common/endpoint/service/trusted_apps/to_update_trusted_app';
 import { SEARCHABLE_FIELDS } from '../constants';
 
@@ -95,11 +98,21 @@ const refreshListIfNeeded = async (
       const pageIndex = getCurrentLocationPageIndex(store.getState());
       const pageSize = getCurrentLocationPageSize(store.getState());
       const filter = getCurrentLocationFilter(store.getState());
+      const includedPolicies = getCurrentLocationIncludedPolicies(store.getState());
+      const excludedPolicies = getCurrentLocationExcludedPolicies(store.getState());
+
+      const kuery = [];
+
+      const filterKuery = parseQueryFilterToKQL(filter, SEARCHABLE_FIELDS) || undefined;
+      if (filterKuery) kuery.push(filterKuery);
+
+      const policiesKuery = parsePoliciesToKQL(includedPolicies, excludedPolicies) || undefined;
+      if (policiesKuery) kuery.push(policiesKuery);
 
       const response = await trustedAppsService.getTrustedAppsList({
         page: pageIndex + 1,
         per_page: pageSize,
-        kuery: parseQueryFilterToKQL(filter, SEARCHABLE_FIELDS) || undefined,
+        kuery: kuery.join(' AND ') || undefined,
       });
 
       store.dispatch(
@@ -112,6 +125,8 @@ const refreshListIfNeeded = async (
             totalItemsCount: response.total,
             timestamp: Date.now(),
             filter,
+            includedPolicies,
+            excludedPolicies,
           },
         })
       );
@@ -311,8 +326,9 @@ export const retrieveListOfPoliciesIfNeeded = async (
   const isLoading = isLoadingResourceState(currentPoliciesState);
   const isPageActive = trustedAppsListPageActive(currentState);
   const isCreateFlow = isCreationDialogLocation(currentState);
+  const isUninitialized = isUninitialisedResourceState(currentPoliciesState);
 
-  if (isPageActive && isCreateFlow && !isLoading) {
+  if (isPageActive && ((isCreateFlow && !isLoading) || isUninitialized)) {
     dispatch({
       type: 'trustedAppsPoliciesStateChanged',
       payload: {
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/mocks.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/mocks.ts
new file mode 100644
index 00000000000000..c97dd37db6bbf0
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/mocks.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { GetPolicyListResponse } from '../../policy/types';
+
+import { EndpointDocGenerator } from '../../../../../common/endpoint/generate_data';
+
+export const getGeneratedPolicyResponse = (): GetPolicyListResponse => ({
+  items: [new EndpointDocGenerator('seed').generatePolicyPackagePolicy()],
+  total: 1,
+  perPage: 1,
+  page: 1,
+});
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/reducer.test.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/reducer.test.ts
index ac4d29a6016b2a..71bea620306760 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/reducer.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/reducer.test.ts
@@ -31,7 +31,7 @@ describe('reducer', () => {
         initialState,
         createUserChangedUrlAction(
           '/administration/trusted_apps',
-          '?page_index=5&page_size=50&show=create&view_type=list&filter=test'
+          '?page_index=5&page_size=50&show=create&view_type=list&filter=test&included_policies=global&excluded_policies=unassigned'
         )
       );
 
@@ -44,6 +44,8 @@ describe('reducer', () => {
           view_type: 'list',
           id: undefined,
           filter: 'test',
+          included_policies: 'global',
+          excluded_policies: 'unassigned',
         },
         active: true,
       });
@@ -53,7 +55,14 @@ describe('reducer', () => {
       const result = trustedAppsPageReducer(
         {
           ...initialState,
-          location: { page_index: 5, page_size: 50, view_type: 'grid', filter: '' },
+          location: {
+            page_index: 5,
+            page_size: 50,
+            view_type: 'grid',
+            filter: '',
+            included_policies: '',
+            excluded_policies: '',
+          },
         },
         createUserChangedUrlAction(
           '/administration/trusted_apps',
@@ -68,7 +77,14 @@ describe('reducer', () => {
       const result = trustedAppsPageReducer(
         {
           ...initialState,
-          location: { page_index: 5, page_size: 50, view_type: 'grid', filter: '' },
+          location: {
+            page_index: 5,
+            page_size: 50,
+            view_type: 'grid',
+            filter: '',
+            included_policies: '',
+            excluded_policies: '',
+          },
         },
         createUserChangedUrlAction('/administration/trusted_apps')
       );
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/selectors.test.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/selectors.test.ts
index 4d8ce097a72633..387a354fe38c4a 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/selectors.test.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/selectors.test.ts
@@ -94,6 +94,8 @@ describe('selectors', () => {
         page_size: 10,
         view_type: 'grid',
         filter: '',
+        included_policies: '',
+        excluded_policies: '',
       };
 
       expect(needsRefreshOfListData({ ...initialState, listView, active: true, location })).toBe(
@@ -176,6 +178,8 @@ describe('selectors', () => {
         page_size: 10,
         view_type: 'grid',
         filter: '',
+        included_policies: '',
+        excluded_policies: '',
       };
 
       expect(getCurrentLocationPageIndex({ ...initialState, location })).toBe(3);
@@ -189,6 +193,8 @@ describe('selectors', () => {
         page_size: 20,
         view_type: 'grid',
         filter: '',
+        included_policies: '',
+        excluded_policies: '',
       };
 
       expect(getCurrentLocationPageSize({ ...initialState, location })).toBe(20);
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/selectors.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/selectors.ts
index 338f30b447a8a7..388d8b5e6ed66d 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/selectors.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/store/selectors.ts
@@ -74,6 +74,18 @@ export const getCurrentLocationFilter = (state: Immutable<TrustedAppsListPageSta
   return state.location.filter;
 };
 
+export const getCurrentLocationIncludedPolicies = (
+  state: Immutable<TrustedAppsListPageState>
+): string => {
+  return state.location.included_policies;
+};
+
+export const getCurrentLocationExcludedPolicies = (
+  state: Immutable<TrustedAppsListPageState>
+): string => {
+  return state.location.excluded_policies;
+};
+
 export const getListTotalItemsCount = (state: Immutable<TrustedAppsListPageState>): number => {
   return getLastLoadedResourceState(state.listView.listResourceState)?.data.totalItemsCount || 0;
 };
@@ -188,6 +200,14 @@ export const entriesExist: (state: Immutable<TrustedAppsListPageState>) => boole
   }
 );
 
+export const prevEntriesExist: (
+  state: Immutable<TrustedAppsListPageState>
+) => boolean = createSelector(entriesExistState, (doEntriesExists) => {
+  return (
+    isLoadingResourceState(doEntriesExists) && !!getLastLoadedResourceState(doEntriesExists)?.data
+  );
+});
+
 export const trustedAppsListPageActive: (state: Immutable<TrustedAppsListPageState>) => boolean = (
   state
 ) => state.active;
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/test_utils/index.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/test_utils/index.ts
index 7783ac96e192d4..cad8f606f85bba 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/test_utils/index.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/test_utils/index.ts
@@ -80,6 +80,8 @@ export const createTrustedAppsListData = (
     totalItemsCount: fullPagination.totalItemCount,
     timestamp,
     filter: '',
+    excludedPolicies: '',
+    includedPolicies: '',
   };
 };
 
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.test.tsx b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.test.tsx
index 5c627d1d7a8373..2ba357a349b5db 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.test.tsx
@@ -173,9 +173,9 @@ describe('When on the Trusted Apps Page', () => {
       expect(addButton.textContent).toBe('Add Trusted Application');
     });
 
-    it('should display the searchbar', async () => {
+    it('should display the searchExceptions', async () => {
       const renderResult = await renderWithListData();
-      expect(await renderResult.findByTestId('searchBar')).not.toBeNull();
+      expect(await renderResult.findByTestId('searchExceptions')).not.toBeNull();
     });
 
     describe('and the Grid view is being displayed', () => {
@@ -774,6 +774,20 @@ describe('When on the Trusted Apps Page', () => {
             return releaseListResponse();
           }
         }
+
+        if (path === PACKAGE_POLICY_API_ROUTES.LIST_PATTERN) {
+          const policy = generator.generatePolicyPackagePolicy();
+          policy.name = 'test policy A';
+          policy.id = 'abc123';
+
+          const response: GetPackagePoliciesResponse = {
+            items: [policy],
+            page: 1,
+            perPage: 1000,
+            total: 1,
+          };
+          return response;
+        }
         if (priorMockImplementation) {
           return priorMockImplementation(path);
         }
@@ -874,12 +888,12 @@ describe('When on the Trusted Apps Page', () => {
       expect(await renderResult.findByTestId('trustedAppEmptyState')).not.toBeNull();
     });
 
-    it('should not display the searchbar', async () => {
+    it('should not display the searchExceptions', async () => {
       const renderResult = render();
       await act(async () => {
         await waitForAction('trustedAppsExistStateChanged');
       });
-      expect(renderResult.queryByTestId('searchBar')).toBeNull();
+      expect(renderResult.queryByTestId('searchExceptions')).toBeNull();
     });
   });
 
@@ -922,6 +936,27 @@ describe('When on the Trusted Apps Page', () => {
           backButtonUrl: '/fleet',
         });
       });
+
+      const priorMockImplementation = coreStart.http.get.getMockImplementation();
+      // @ts-ignore
+      coreStart.http.get.mockImplementation((path, options) => {
+        if (path === PACKAGE_POLICY_API_ROUTES.LIST_PATTERN) {
+          const policy = generator.generatePolicyPackagePolicy();
+          policy.name = 'test policy A';
+          policy.id = 'abc123';
+
+          const response: GetPackagePoliciesResponse = {
+            items: [policy],
+            page: 1,
+            perPage: 1000,
+            total: 1,
+          };
+          return response;
+        }
+        if (priorMockImplementation) {
+          return priorMockImplementation(path);
+        }
+      });
     });
 
     it('back button is present', () => {
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.tsx b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.tsx
index ec80b4c5ae21b5..48ff54a0e3b56f 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/trusted_apps_page.tsx
@@ -26,6 +26,8 @@ import {
   entriesExist,
   getCurrentLocation,
   getListTotalItemsCount,
+  listOfPolicies,
+  prevEntriesExist,
 } from '../store/selectors';
 import { useTrustedAppsNavigateCallback, useTrustedAppsSelector } from './hooks';
 import { AdministrationListPage } from '../../../components/administration_list_page';
@@ -38,18 +40,31 @@ import { TrustedAppsNotifications } from './trusted_apps_notifications';
 import { AppAction } from '../../../../common/store/actions';
 import { ABOUT_TRUSTED_APPS, SEARCH_TRUSTED_APP_PLACEHOLDER } from './translations';
 import { EmptyState } from './components/empty_state';
-import { SearchBar } from '../../../components/search_bar';
+import { SearchExceptions } from '../../../components/search_exceptions';
 import { BackToExternalAppButton } from '../../../components/back_to_external_app_button';
 import { ListPageRouteState } from '../../../../../common/endpoint/types';
+import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features';
 
 export const TrustedAppsPage = memo(() => {
+  const isTrustedAppsByPolicyEnabled = useIsExperimentalFeatureEnabled(
+    'trustedAppsByPolicyEnabled'
+  );
   const dispatch = useDispatch<Dispatch<AppAction>>();
   const { state: routeState } = useLocation<ListPageRouteState | undefined>();
   const location = useTrustedAppsSelector(getCurrentLocation);
   const totalItemsCount = useTrustedAppsSelector(getListTotalItemsCount);
   const isCheckingIfEntriesExists = useTrustedAppsSelector(checkingIfEntriesExist);
-  const doEntriesExist = useTrustedAppsSelector(entriesExist) === true;
-  const navigationCallback = useTrustedAppsNavigateCallback((query: string) => ({ filter: query }));
+  const policyList = useTrustedAppsSelector(listOfPolicies);
+  const doEntriesExist = useTrustedAppsSelector(entriesExist);
+  const didEntriesExist = useTrustedAppsSelector(prevEntriesExist);
+  const navigationCallbackQuery = useTrustedAppsNavigateCallback(
+    (query: string, includedPolicies?: string, excludedPolicies?: string) => ({
+      filter: query,
+      included_policies: includedPolicies,
+      excluded_policies: excludedPolicies,
+    })
+  );
+
   const handleAddButtonClick = useTrustedAppsNavigateCallback(() => ({
     show: 'create',
     id: undefined,
@@ -61,12 +76,13 @@ export const TrustedAppsPage = memo(() => {
   const handleViewTypeChange = useTrustedAppsNavigateCallback((viewType: ViewType) => ({
     view_type: viewType,
   }));
+
   const handleOnSearch = useCallback(
-    (query: string) => {
+    (query: string, includedPolicies?: string, excludedPolicies?: string) => {
       dispatch({ type: 'trustedAppForceRefresh', payload: { forceRefresh: true } });
-      navigationCallback(query);
+      navigationCallbackQuery(query, includedPolicies, excludedPolicies);
     },
-    [dispatch, navigationCallback]
+    [dispatch, navigationCallbackQuery]
   );
 
   const showCreateFlyout = !!location.show;
@@ -105,12 +121,16 @@ export const TrustedAppsPage = memo(() => {
         />
       )}
 
-      {doEntriesExist ? (
+      {doEntriesExist || (isCheckingIfEntriesExists && didEntriesExist) ? (
         <>
-          <SearchBar
+          <SearchExceptions
             defaultValue={location.filter}
             onSearch={handleOnSearch}
             placeholder={SEARCH_TRUSTED_APP_PLACEHOLDER}
+            hasPolicyFilter={isTrustedAppsByPolicyEnabled}
+            policyList={policyList}
+            defaultExcludedPolicies={location.excluded_policies}
+            defaultIncludedPolicies={location.included_policies}
           />
           <EuiFlexGroup
             direction="column"
@@ -157,7 +177,7 @@ export const TrustedAppsPage = memo(() => {
     >
       <TrustedAppsNotifications />
 
-      {isCheckingIfEntriesExists ? (
+      {isCheckingIfEntriesExists && !didEntriesExist ? (
         <EuiEmptyPrompt
           data-test-subj="trustedAppsListLoader"
           body={<EuiLoadingSpinner className="essentialAnimation" size="xl" />}
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.test.tsx b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.test.tsx
index 4c738958e9be87..63a4571ca11e52 100644
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.test.tsx
@@ -32,7 +32,12 @@ jest.mock('../../../common/lib/kibana', () => {
         embeddable: {
           EmbeddablePanel: jest.fn(() => <div data-test-subj="EmbeddablePanel" />),
         },
-        docLinks: { ELASTIC_WEBSITE_URL: 'ELASTIC_WEBSITE_URL' },
+        docLinks: {
+          ELASTIC_WEBSITE_URL: 'ELASTIC_WEBSITE_URL',
+          links: {
+            siem: { networkMap: '' },
+          },
+        },
       },
     }),
   };
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx
index 6e36b85e3819ca..f2cb974a5b5c1a 100644
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx
@@ -221,10 +221,7 @@ export const EmbeddedMapComponent = ({
     <Embeddable>
       <EmbeddableHeader title={i18n.EMBEDDABLE_HEADER_TITLE}>
         <EuiText size="xs">
-          <EuiLink
-            href={`${services.docLinks.ELASTIC_WEBSITE_URL}guide/en/security/${services.docLinks.DOC_LINK_VERSION}/conf-map-ui.html`}
-            target="_blank"
-          >
+          <EuiLink href={`${services.docLinks.links.siem.networkMap}`} target="_blank">
             {i18n.EMBEDDABLE_HEADER_HELP}
           </EuiLink>
         </EuiText>
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/index_patterns_missing_prompt.tsx b/x-pack/plugins/security_solution/public/network/components/embeddables/index_patterns_missing_prompt.tsx
index 43e57e519e2388..b0e2e6cd7f1862 100644
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/index_patterns_missing_prompt.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/embeddables/index_patterns_missing_prompt.tsx
@@ -39,7 +39,7 @@ export const IndexPatternsMissingPromptComponent = () => {
                 ),
                 beats: (
                   <a
-                    href={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/beats/libbeat/${docLinks.DOC_LINK_VERSION}/getting-started.html`}
+                    href={`${docLinks.links.libbeat.getStarted}`}
                     rel="noopener noreferrer"
                     target="_blank"
                   >
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/side_panel/__snapshots__/index.test.tsx.snap
index 8118555cd64d85..3b365306447b43 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/__snapshots__/index.test.tsx.snap
@@ -261,7 +261,7 @@ Array [
   -ms-flex: 1;
   flex: 1;
   overflow: hidden;
-  padding: 4px 16px 50px;
+  padding: 16px;
 }
 
 <EuiFlyout
@@ -454,6 +454,53 @@ Array [
             </div>
           </EuiFlyoutBody>
         </Styled(EuiFlyoutBody)>
+        <Memo()
+          detailsData={null}
+          expandedEvent={
+            Object {
+              "eventId": "my-id",
+              "indexName": "my-index",
+            }
+          }
+          handleOnEventClosed={[Function]}
+          isHostIsolationPanelOpen={false}
+          loadingEventDetails={true}
+          onAddIsolationStatusClick={[Function]}
+          timelineId="test"
+        >
+          <EuiFlyoutFooter>
+            <div
+              className="euiFlyoutFooter"
+            >
+              <EuiFlexGroup
+                justifyContent="flexEnd"
+              >
+                <div
+                  className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--justifyContentFlexEnd euiFlexGroup--directionRow euiFlexGroup--responsive"
+                >
+                  <EuiFlexItem
+                    grow={false}
+                  >
+                    <div
+                      className="euiFlexItem euiFlexItem--flexGrowZero"
+                    >
+                      <Memo()
+                        detailsData={null}
+                        handleOnEventClosed={[Function]}
+                        isHostIsolationPanelOpen={false}
+                        loadingEventDetails={true}
+                        onAddEventFilterClick={[Function]}
+                        onAddExceptionTypeClick={[Function]}
+                        onAddIsolationStatusClick={[Function]}
+                        timelineId="test"
+                      />
+                    </div>
+                  </EuiFlexItem>
+                </div>
+              </EuiFlexGroup>
+            </div>
+          </EuiFlyoutFooter>
+        </Memo()>
       </EventDetailsPanelComponent>
     </div>
   </EuiFlyout>,
@@ -480,7 +527,7 @@ Array [
   -ms-flex: 1;
   flex: 1;
   overflow: hidden;
-  padding: 4px 16px 50px;
+  padding: 16px;
 }
 
 <div
@@ -667,6 +714,53 @@ Array [
           </div>
         </EuiFlyoutBody>
       </Styled(EuiFlyoutBody)>
+      <Memo()
+        detailsData={null}
+        expandedEvent={
+          Object {
+            "eventId": "my-id",
+            "indexName": "my-index",
+          }
+        }
+        handleOnEventClosed={[Function]}
+        isHostIsolationPanelOpen={false}
+        loadingEventDetails={true}
+        onAddIsolationStatusClick={[Function]}
+        timelineId="test"
+      >
+        <EuiFlyoutFooter>
+          <div
+            className="euiFlyoutFooter"
+          >
+            <EuiFlexGroup
+              justifyContent="flexEnd"
+            >
+              <div
+                className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--justifyContentFlexEnd euiFlexGroup--directionRow euiFlexGroup--responsive"
+              >
+                <EuiFlexItem
+                  grow={false}
+                >
+                  <div
+                    className="euiFlexItem euiFlexItem--flexGrowZero"
+                  >
+                    <Memo()
+                      detailsData={null}
+                      handleOnEventClosed={[Function]}
+                      isHostIsolationPanelOpen={false}
+                      loadingEventDetails={true}
+                      onAddEventFilterClick={[Function]}
+                      onAddExceptionTypeClick={[Function]}
+                      onAddIsolationStatusClick={[Function]}
+                      timelineId="test"
+                    />
+                  </div>
+                </EuiFlexItem>
+              </div>
+            </EuiFlexGroup>
+          </div>
+        </EuiFlyoutFooter>
+      </Memo()>
     </EventDetailsPanelComponent>
   </div>,
 ]
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/footer.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/footer.tsx
new file mode 100644
index 00000000000000..cb8ed537543a02
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/footer.tsx
@@ -0,0 +1,138 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useMemo } from 'react';
+import { EuiFlyoutFooter, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { find, get } from 'lodash/fp';
+import { TakeActionDropdown } from '../../../../detections/components/take_action_dropdown';
+import type { TimelineEventsDetailsItem } from '../../../../../common';
+import { useExceptionModal } from '../../../../detections/components/alerts_table/timeline_actions/use_add_exception_modal';
+import { AddExceptionModalWrapper } from '../../../../detections/components/alerts_table/timeline_actions/alert_context_menu';
+import { EventFiltersModal } from '../../../../management/pages/event_filters/view/components/modal';
+import { useEventFilterModal } from '../../../../detections/components/alerts_table/timeline_actions/use_event_filter_modal';
+import { getFieldValue } from '../../../../detections/components/host_isolation/helpers';
+import { Status } from '../../../../../common/detection_engine/schemas/common/schemas';
+import { useFetchEcsAlertsData } from '../../../../detections/containers/detection_engine/alerts/use_fetch_ecs_alerts_data';
+
+interface EventDetailsFooterProps {
+  detailsData: TimelineEventsDetailsItem[] | null;
+  expandedEvent: {
+    eventId: string;
+    indexName: string;
+    refetch?: () => void;
+  };
+  handleOnEventClosed: () => void;
+  isHostIsolationPanelOpen: boolean;
+  loadingEventDetails: boolean;
+  onAddIsolationStatusClick: (action: 'isolateHost' | 'unisolateHost') => void;
+  timelineId: string;
+}
+
+interface AddExceptionModalWrapperData {
+  alertStatus: Status;
+  eventId: string;
+  ruleId: string;
+  ruleName: string;
+}
+
+export const EventDetailsFooter = React.memo(
+  ({
+    detailsData,
+    expandedEvent,
+    handleOnEventClosed,
+    isHostIsolationPanelOpen,
+    loadingEventDetails,
+    onAddIsolationStatusClick,
+    timelineId,
+  }: EventDetailsFooterProps) => {
+    const ruleIndex = useMemo(
+      () => find({ category: 'signal', field: 'signal.rule.index' }, detailsData)?.values,
+      [detailsData]
+    );
+
+    const addExceptionModalWrapperData = useMemo(
+      () =>
+        [
+          { category: 'signal', field: 'signal.rule.id', name: 'ruleId' },
+          { category: 'signal', field: 'signal.rule.name', name: 'ruleName' },
+          { category: 'signal', field: 'signal.status', name: 'alertStatus' },
+          { category: '_id', field: '_id', name: 'eventId' },
+        ].reduce<AddExceptionModalWrapperData>(
+          (acc, curr) => ({
+            ...acc,
+            [curr.name]: getFieldValue({ category: curr.category, field: curr.field }, detailsData),
+          }),
+          {} as AddExceptionModalWrapperData
+        ),
+      [detailsData]
+    );
+
+    const eventIds = useMemo(() => [expandedEvent?.eventId], [expandedEvent?.eventId]);
+
+    const {
+      exceptionModalType,
+      onAddExceptionTypeClick,
+      onAddExceptionCancel,
+      onAddExceptionConfirm,
+      ruleIndices,
+    } = useExceptionModal({
+      ruleIndex,
+      refetch: expandedEvent?.refetch,
+      timelineId,
+    });
+    const {
+      closeAddEventFilterModal,
+      isAddEventFilterModalOpen,
+      onAddEventFilterClick,
+    } = useEventFilterModal();
+
+    const { alertsEcsData } = useFetchEcsAlertsData({
+      alertIds: eventIds,
+      skip: expandedEvent?.eventId == null,
+    });
+
+    const ecsData = get(0, alertsEcsData);
+    return (
+      <>
+        <EuiFlyoutFooter>
+          <EuiFlexGroup justifyContent="flexEnd">
+            <EuiFlexItem grow={false}>
+              <TakeActionDropdown
+                detailsData={detailsData}
+                handleOnEventClosed={handleOnEventClosed}
+                isHostIsolationPanelOpen={isHostIsolationPanelOpen}
+                loadingEventDetails={loadingEventDetails}
+                onAddEventFilterClick={onAddEventFilterClick}
+                onAddExceptionTypeClick={onAddExceptionTypeClick}
+                onAddIsolationStatusClick={onAddIsolationStatusClick}
+                refetch={expandedEvent?.refetch}
+                timelineId={timelineId}
+              />
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiFlyoutFooter>
+        {/* This is still wrong to do render flyout/modal inside of the flyout
+        We need to completely refactor the EventDetails  component to be correct
+      */}
+        {exceptionModalType != null &&
+          addExceptionModalWrapperData.ruleId != null &&
+          addExceptionModalWrapperData.eventId != null && (
+            <AddExceptionModalWrapper
+              {...addExceptionModalWrapperData}
+              ruleIndices={ruleIndices}
+              exceptionListType={exceptionModalType}
+              onCancel={onAddExceptionCancel}
+              onConfirm={onAddExceptionConfirm}
+            />
+          )}
+        {isAddEventFilterModalOpen && ecsData != null && (
+          <EventFiltersModal data={ecsData} onCancel={closeAddEventFilterModal} />
+        )}
+      </>
+    );
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
index 90af9d871e0c75..82e994802c650b 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
@@ -5,14 +5,11 @@
  * 2.0.
  */
 
-import { find, some } from 'lodash/fp';
+import { some } from 'lodash/fp';
 import {
   EuiButtonEmpty,
   EuiFlyoutHeader,
   EuiFlyoutBody,
-  EuiFlyoutFooter,
-  EuiFlexGroup,
-  EuiFlexItem,
   EuiSpacer,
   EuiTitle,
   EuiText,
@@ -26,17 +23,16 @@ import { useTimelineEventsDetails } from '../../../containers/details';
 import { TimelineTabs } from '../../../../../common/types/timeline';
 import { HostIsolationPanel } from '../../../../detections/components/host_isolation';
 import { EndpointIsolateSuccess } from '../../../../common/components/endpoint/host_isolation';
-import { TakeActionDropdown } from '../../../../detections/components/host_isolation/take_action_dropdown';
 import {
   ISOLATE_HOST,
   UNISOLATE_HOST,
 } from '../../../../detections/components/host_isolation/translations';
+import { getFieldValue } from '../../../../detections/components/host_isolation/helpers';
 import { ALERT_DETAILS } from './translations';
-import { useIsolationPrivileges } from '../../../../common/hooks/endpoint/use_isolate_privileges';
-import { isIsolationSupported } from '../../../../../common/endpoint/service/host_isolation/utils';
-import { endpointAlertCheck } from '../../../../common/utils/endpoint_alert_check';
 import { useWithCaseDetailsRefresh } from '../../../../common/components/endpoint/host_isolation/endpoint_host_isolation_cases_context';
-import { TimelineEventsDetailsItem } from '../../../../../common';
+import { TimelineNonEcsData } from '../../../../../common';
+import { Ecs } from '../../../../../common/ecs';
+import { EventDetailsFooter } from './footer';
 
 const StyledEuiFlyoutBody = styled(EuiFlyoutBody)`
   .euiFlyoutBody__overflow {
@@ -47,29 +43,21 @@ const StyledEuiFlyoutBody = styled(EuiFlyoutBody)`
     .euiFlyoutBody__overflowContent {
       flex: 1;
       overflow: hidden;
-      padding: ${({ theme }) => `${theme.eui.paddingSizes.xs} ${theme.eui.paddingSizes.m} 50px`};
+      padding: ${({ theme }) => `${theme.eui.paddingSizes.m}`};
     }
   }
 `;
 
-const getFieldValue = (
-  {
-    category,
-    field,
-  }: {
-    category: string;
-    field: string;
-  },
-  data: TimelineEventsDetailsItem[] | null
-) => {
-  const currentField = find({ category, field }, data)?.values;
-  return currentField && currentField.length > 0 ? currentField[0] : '';
-};
-
 interface EventDetailsPanelProps {
   browserFields: BrowserFields;
   docValueFields: DocValueFields[];
-  expandedEvent: { eventId: string; indexName: string };
+  expandedEvent: {
+    eventId: string;
+    indexName: string;
+    ecsData?: Ecs;
+    nonEcsData?: TimelineNonEcsData[];
+    refetch?: () => void;
+  };
   handleOnEventClosed: () => void;
   isFlyoutView?: boolean;
   tabType: TimelineTabs;
@@ -107,7 +95,6 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
     setIsIsolateActionSuccessBannerVisible(false);
   }, []);
 
-  const { isAllowed: isIsolationAllowed } = useIsolationPrivileges();
   const showHostIsolationPanel = useCallback((action) => {
     if (action === 'isolateHost' || action === 'unisolateHost') {
       setIsHostIsolationPanel(true);
@@ -117,30 +104,11 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
 
   const isAlert = some({ category: 'signal', field: 'signal.rule.id' }, detailsData);
 
-  const isEndpointAlert = useMemo(() => {
-    return endpointAlertCheck({ data: detailsData || [] });
-  }, [detailsData]);
-
   const ruleName = useMemo(
     () => getFieldValue({ category: 'signal', field: 'signal.rule.name' }, detailsData),
     [detailsData]
   );
 
-  const agentId = useMemo(
-    () => getFieldValue({ category: 'agent', field: 'agent.id' }, detailsData),
-    [detailsData]
-  );
-
-  const hostOsFamily = useMemo(
-    () => getFieldValue({ category: 'host', field: 'host.os.name' }, detailsData),
-    [detailsData]
-  );
-
-  const agentVersion = useMemo(
-    () => getFieldValue({ category: 'agent', field: 'agent.version' }, detailsData),
-    [detailsData]
-  );
-
   const alertId = useMemo(() => getFieldValue({ category: '_id', field: '_id' }, detailsData), [
     detailsData,
   ]);
@@ -150,11 +118,6 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
     [detailsData]
   );
 
-  const isolationSupported = isIsolationSupported({
-    osName: hostOsFamily,
-    version: agentVersion,
-  });
-
   const backToAlertDetailsLink = useMemo(() => {
     return (
       <>
@@ -225,18 +188,16 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
           />
         )}
       </StyledEuiFlyoutBody>
-      {isIsolationAllowed &&
-        isEndpointAlert &&
-        isolationSupported &&
-        isHostIsolationPanelOpen === false && (
-          <EuiFlyoutFooter>
-            <EuiFlexGroup justifyContent="flexEnd">
-              <EuiFlexItem grow={false}>
-                <TakeActionDropdown onChange={showHostIsolationPanel} agentId={agentId} />
-              </EuiFlexItem>
-            </EuiFlexGroup>
-          </EuiFlyoutFooter>
-        )}
+
+      <EventDetailsFooter
+        detailsData={detailsData}
+        expandedEvent={expandedEvent}
+        handleOnEventClosed={handleOnEventClosed}
+        isHostIsolationPanelOpen={isHostIsolationPanelOpen}
+        loadingEventDetails={loading}
+        onAddIsolationStatusClick={showHostIsolationPanel}
+        timelineId={timelineId}
+      />
     </>
   ) : (
     <>
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/action_icon_item.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/action_icon_item.tsx
index 4bbcbf4e159812..2e2e912f5abfab 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/action_icon_item.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/action_icon_item.tsx
@@ -6,7 +6,7 @@
  */
 
 import React, { MouseEvent } from 'react';
-import { EuiButtonIcon, EuiToolTip } from '@elastic/eui';
+import { EuiContextMenuItem, EuiButtonIcon, EuiToolTip, EuiText } from '@elastic/eui';
 
 import { EventsTdContent } from '../../styles';
 import { DEFAULT_ICON_BUTTON_WIDTH } from '../../helpers';
@@ -20,6 +20,7 @@ interface ActionIconItemProps {
   isDisabled?: boolean;
   onClick?: (event: MouseEvent) => void;
   children?: React.ReactNode;
+  buttonType?: 'text' | 'icon';
 }
 
 const ActionIconItemComponent: React.FC<ActionIconItemProps> = ({
@@ -31,22 +32,41 @@ const ActionIconItemComponent: React.FC<ActionIconItemProps> = ({
   isDisabled = false,
   onClick,
   children,
+  buttonType = 'icon',
 }) => (
-  <div>
-    <EventsTdContent textAlign="center" width={width}>
-      {children ?? (
-        <EuiToolTip data-test-subj={`${dataTestSubj}-tool-tip`} content={content}>
-          <EuiButtonIcon
-            aria-label={ariaLabel}
-            data-test-subj={`${dataTestSubj}-button`}
-            iconType={iconType}
-            isDisabled={isDisabled}
-            onClick={onClick}
-          />
-        </EuiToolTip>
-      )}
-    </EventsTdContent>
-  </div>
+  <>
+    {buttonType === 'icon' && (
+      <div>
+        <EventsTdContent textAlign="center" width={width}>
+          {children ?? (
+            <EuiToolTip data-test-subj={`${dataTestSubj}-tool-tip`} content={content}>
+              <EuiButtonIcon
+                aria-label={ariaLabel}
+                data-test-subj={`${dataTestSubj}-button`}
+                iconType={iconType}
+                isDisabled={isDisabled}
+                onClick={onClick}
+              />
+            </EuiToolTip>
+          )}
+        </EventsTdContent>
+      </div>
+    )}
+    {buttonType === 'text' && (
+      <EuiContextMenuItem
+        aria-label={ariaLabel}
+        data-test-subj={`${dataTestSubj}-button-menu-item`}
+        disabled={isDisabled}
+        onClick={onClick}
+        color="text"
+        size="s"
+      >
+        <EuiText data-test-subj={`${dataTestSubj}-button`} size="m">
+          {content}
+        </EuiText>
+      </EuiContextMenuItem>
+    )}
+  </>
 );
 
 ActionIconItemComponent.displayName = 'ActionIconItemComponent';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx
index b8840a75cc9b4e..302aead337ed70 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/stateful_event.tsx
@@ -185,6 +185,7 @@ const StatefulEventComponent: React.FC<Props> = ({
       params: {
         eventId,
         indexName,
+        refetch,
       },
     };
 
@@ -199,7 +200,7 @@ const StatefulEventComponent: React.FC<Props> = ({
     if (timelineId === TimelineId.active && tabType === TimelineTabs.query) {
       activeTimeline.toggleExpandedDetail({ ...updatedExpandedDetail });
     }
-  }, [dispatch, event._id, event._index, tabType, timelineId]);
+  }, [dispatch, event._id, event._index, refetch, tabType, timelineId]);
 
   const associateNote = useCallback(
     (noteId: string) => {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
index 19059b5fb45994..87fb4ee762ab01 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/index.test.tsx
@@ -68,6 +68,7 @@ jest.mock('../../../../common/lib/helpers/scheduler', () => ({
 
 describe('Body', () => {
   const mount = useMountAppended();
+  const mockRefetch = jest.fn();
   const props: StatefulBodyProps = {
     activePage: 0,
     browserFields: mockBrowserFields,
@@ -80,7 +81,7 @@ describe('Body', () => {
     isSelectAllChecked: false,
     loadingEventIds: [],
     pinnedEventIds: {},
-    refetch: jest.fn(),
+    refetch: mockRefetch,
     renderCellValue: DefaultCellRenderer,
     rowRenderers: defaultRowRenderers,
     selectedEventIds: {},
@@ -253,6 +254,7 @@ describe('Body', () => {
           params: {
             eventId: '1',
             indexName: undefined,
+            refetch: mockRefetch,
           },
           tabType: 'query',
           timelineId: 'timeline-test',
@@ -277,6 +279,7 @@ describe('Body', () => {
           params: {
             eventId: '1',
             indexName: undefined,
+            refetch: mockRefetch,
           },
           tabType: 'pinned',
           timelineId: 'timeline-test',
@@ -301,6 +304,7 @@ describe('Body', () => {
           params: {
             eventId: '1',
             indexName: undefined,
+            refetch: mockRefetch,
           },
           tabType: 'notes',
           timelineId: 'timeline-test',
diff --git a/x-pack/plugins/security_solution/server/client/client.ts b/x-pack/plugins/security_solution/server/client/client.ts
index ffab9a1cbdfbff..a94a0fa920c651 100644
--- a/x-pack/plugins/security_solution/server/client/client.ts
+++ b/x-pack/plugins/security_solution/server/client/client.ts
@@ -9,12 +9,15 @@ import { ConfigType } from '../config';
 
 export class AppClient {
   private readonly signalsIndex: string;
+  private readonly spaceId: string;
 
-  constructor(private spaceId: string, private config: ConfigType) {
+  constructor(_spaceId: string, private config: ConfigType) {
     const configuredSignalsIndex = this.config.signalsIndex;
 
-    this.signalsIndex = `${configuredSignalsIndex}-${this.spaceId}`;
+    this.signalsIndex = `${configuredSignalsIndex}-${_spaceId}`;
+    this.spaceId = _spaceId;
   }
 
   public getSignalsIndex = (): string => this.signalsIndex;
+  public getSpaceId = (): string => this.spaceId;
 }
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/test_support.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/test_support.ts
index a0530590f5f9fe..7dae6fe5c69e49 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/test_support.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/test_support.ts
@@ -5,10 +5,12 @@
  * 2.0.
  */
 
-import { SearchResponse } from 'elasticsearch';
+import type { estypes } from '@elastic/elasticsearch';
 import { HostMetadata } from '../../../../../common/endpoint/types';
 
-export function createV2SearchResponse(hostMetadata?: HostMetadata): SearchResponse<HostMetadata> {
+export function createV2SearchResponse(
+  hostMetadata?: HostMetadata
+): estypes.SearchResponse<HostMetadata> {
   return ({
     took: 15,
     timed_out: false,
@@ -38,5 +40,5 @@ export function createV2SearchResponse(hostMetadata?: HostMetadata): SearchRespo
           ]
         : [],
     },
-  } as unknown) as SearchResponse<HostMetadata>;
+  } as unknown) as estypes.SearchResponse<HostMetadata>;
 }
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/policy/handlers.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/policy/handlers.test.ts
index c8b36a22b359a4..2b5fe11a8f6879 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/policy/handlers.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/policy/handlers.test.ts
@@ -22,7 +22,7 @@ import {
   loggingSystemMock,
   savedObjectsClientMock,
 } from '../../../../../../../src/core/server/mocks';
-import { SearchResponse } from 'elasticsearch';
+import type { estypes } from '@elastic/elasticsearch';
 import { GetHostPolicyResponse, HostPolicyResponse } from '../../../../common/endpoint/types';
 import { EndpointDocGenerator } from '../../../../common/endpoint/generate_data';
 import { parseExperimentalConfigValue } from '../../../../common/experimental_features';
@@ -239,7 +239,7 @@ describe('test policy response handler', () => {
  */
 function createSearchResponse(
   hostPolicyResponse?: HostPolicyResponse
-): SearchResponse<HostPolicyResponse> {
+): estypes.SearchResponse<HostPolicyResponse> {
   return ({
     took: 15,
     timed_out: false,
@@ -267,5 +267,5 @@ function createSearchResponse(
           ]
         : [],
     },
-  } as unknown) as SearchResponse<HostPolicyResponse>;
+  } as unknown) as estypes.SearchResponse<HostPolicyResponse>;
 }
diff --git a/x-pack/plugins/security_solution/server/endpoint/services/metadata/metadata.ts b/x-pack/plugins/security_solution/server/endpoint/services/metadata/metadata.ts
index 2700bd80ca073e..6bf062c02732e8 100644
--- a/x-pack/plugins/security_solution/server/endpoint/services/metadata/metadata.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/metadata/metadata.ts
@@ -5,8 +5,7 @@
  * 2.0.
  */
 
-import { SearchRequest } from '@elastic/elasticsearch/api/types';
-import { SearchResponse } from 'elasticsearch';
+import type { estypes } from '@elastic/elasticsearch';
 import { HostMetadata } from '../../../../common/endpoint/types';
 import { SecuritySolutionRequestHandlerContext } from '../../../types';
 import { getESQueryHostMetadataByIDs } from '../../routes/metadata/query_builders';
@@ -20,7 +19,7 @@ export async function getMetadataForEndpoints(
 ): Promise<HostMetadata[]> {
   const query = getESQueryHostMetadataByIDs(endpointIDs);
   const esClient = requestHandlerContext.core.elasticsearch.client.asCurrentUser;
-  const { body } = await esClient.search<HostMetadata>(query as SearchRequest);
-  const hosts = queryResponseToHostListResult(body as SearchResponse<HostMetadata>);
+  const { body } = await esClient.search<HostMetadata>(query as estypes.SearchRequest);
+  const hosts = queryResponseToHostListResult(body as estypes.SearchResponse<HostMetadata>);
   return hosts.resultList;
 }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/__snapshots__/get_signals_template.test.ts.snap b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/__snapshots__/get_signals_template.test.ts.snap
index 4f060746b92b0c..80ae8b9309f1f2 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/__snapshots__/get_signals_template.test.ts.snap
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/__snapshots__/get_signals_template.test.ts.snap
@@ -5,4529 +5,4917 @@ Object {
   "index_patterns": Array [
     "test-index-*",
   ],
-  "mappings": Object {
-    "_meta": Object {
-      "version": 45,
+  "template": Object {
+    "aliases": Object {
+      ".alerts-security.alerts-space-id": Object {
+        "is_write_index": false,
+      },
     },
-    "dynamic": false,
-    "properties": Object {
-      "@timestamp": Object {
-        "type": "date",
+    "mappings": Object {
+      "_meta": Object {
+        "aliases_version": 1,
+        "version": 55,
       },
-      "agent": Object {
-        "properties": Object {
-          "build": Object {
-            "properties": Object {
-              "original": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+      "dynamic": false,
+      "properties": Object {
+        "@timestamp": Object {
+          "type": "date",
+        },
+        "agent": Object {
+          "properties": Object {
+            "build": Object {
+              "properties": Object {
+                "original": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
             },
-          },
-          "ephemeral_id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "type": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "version": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+            "ephemeral_id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "type": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "version": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
         },
-      },
-      "as": Object {
-        "properties": Object {
-          "number": Object {
-            "type": "long",
-          },
-          "organization": Object {
-            "properties": Object {
-              "name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
+        "as": Object {
+          "properties": Object {
+            "number": Object {
+              "type": "long",
+            },
+            "organization": Object {
+              "properties": Object {
+                "name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
               },
             },
           },
         },
-      },
-      "client": Object {
-        "properties": Object {
-          "address": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "as": Object {
-            "properties": Object {
-              "number": Object {
-                "type": "long",
-              },
-              "organization": Object {
-                "properties": Object {
-                  "name": Object {
-                    "fields": Object {
-                      "text": Object {
-                        "norms": false,
-                        "type": "text",
+        "client": Object {
+          "properties": Object {
+            "address": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "as": Object {
+              "properties": Object {
+                "number": Object {
+                  "type": "long",
+                },
+                "organization": Object {
+                  "properties": Object {
+                    "name": Object {
+                      "fields": Object {
+                        "text": Object {
+                          "norms": false,
+                          "type": "text",
+                        },
                       },
+                      "ignore_above": 1024,
+                      "type": "keyword",
                     },
-                    "ignore_above": 1024,
-                    "type": "keyword",
                   },
                 },
               },
             },
-          },
-          "bytes": Object {
-            "type": "long",
-          },
-          "domain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "geo": Object {
-            "properties": Object {
-              "city_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "continent_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "continent_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "country_iso_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "country_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "location": Object {
-                "type": "geo_point",
-              },
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "postal_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "region_iso_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "region_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "timezone": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
+            "bytes": Object {
+              "type": "long",
             },
-          },
-          "ip": Object {
-            "type": "ip",
-          },
-          "mac": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "nat": Object {
-            "properties": Object {
-              "ip": Object {
-                "type": "ip",
-              },
-              "port": Object {
-                "type": "long",
-              },
+            "domain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-          },
-          "packets": Object {
-            "type": "long",
-          },
-          "port": Object {
-            "type": "long",
-          },
-          "registered_domain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "subdomain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "top_level_domain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "user": Object {
-            "properties": Object {
-              "domain": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "email": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            "geo": Object {
+              "properties": Object {
+                "city_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "continent_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "continent_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "country_iso_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "country_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "location": Object {
+                  "type": "geo_point",
+                },
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "postal_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "region_iso_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "region_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "timezone": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
-              "full_name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
-                  },
+            },
+            "ip": Object {
+              "type": "ip",
+            },
+            "mac": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "nat": Object {
+              "properties": Object {
+                "ip": Object {
+                  "type": "ip",
+                },
+                "port": Object {
+                  "type": "long",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
               },
-              "group": Object {
-                "properties": Object {
-                  "domain": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "id": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+            },
+            "packets": Object {
+              "type": "long",
+            },
+            "port": Object {
+              "type": "long",
+            },
+            "registered_domain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "subdomain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "top_level_domain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "user": Object {
+              "properties": Object {
+                "domain": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "email": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "full_name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
-                  "name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "group": Object {
+                  "properties": Object {
+                    "domain": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "id": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
-              },
-              "hash": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
+                "hash": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "roles": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "roles": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
               },
             },
           },
         },
-      },
-      "cloud": Object {
-        "properties": Object {
-          "account": Object {
-            "properties": Object {
-              "id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+        "cloud": Object {
+          "properties": Object {
+            "account": Object {
+              "properties": Object {
+                "id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
             },
-          },
-          "availability_zone": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "instance": Object {
-            "properties": Object {
-              "id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
+            "availability_zone": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-          },
-          "machine": Object {
-            "properties": Object {
-              "type": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            "instance": Object {
+              "properties": Object {
+                "id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
             },
-          },
-          "project": Object {
-            "properties": Object {
-              "id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            "machine": Object {
+              "properties": Object {
+                "type": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            },
+            "project": Object {
+              "properties": Object {
+                "id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
             },
-          },
-          "provider": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "region": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "service": Object {
-            "properties": Object {
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            "provider": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "region": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "service": Object {
+              "properties": Object {
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
             },
           },
         },
-      },
-      "code_signature": Object {
-        "properties": Object {
-          "exists": Object {
-            "type": "boolean",
-          },
-          "status": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "subject_name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "trusted": Object {
-            "type": "boolean",
-          },
-          "valid": Object {
-            "type": "boolean",
+        "code_signature": Object {
+          "properties": Object {
+            "exists": Object {
+              "type": "boolean",
+            },
+            "status": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "subject_name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "trusted": Object {
+              "type": "boolean",
+            },
+            "valid": Object {
+              "type": "boolean",
+            },
           },
         },
-      },
-      "container": Object {
-        "properties": Object {
-          "id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "image": Object {
-            "properties": Object {
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "tag": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+        "container": Object {
+          "properties": Object {
+            "id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "image": Object {
+              "properties": Object {
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "tag": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
             },
-          },
-          "labels": Object {
-            "type": "object",
-          },
-          "name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "runtime": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+            "labels": Object {
+              "type": "object",
+            },
+            "name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "runtime": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
         },
-      },
-      "data_stream": Object {
-        "properties": Object {
-          "dataset": Object {
-            "type": "keyword",
-          },
-          "namespace": Object {
-            "type": "keyword",
-          },
-          "type": Object {
-            "type": "keyword",
+        "data_stream": Object {
+          "properties": Object {
+            "dataset": Object {
+              "type": "keyword",
+            },
+            "namespace": Object {
+              "type": "keyword",
+            },
+            "type": Object {
+              "type": "keyword",
+            },
           },
         },
-      },
-      "destination": Object {
-        "properties": Object {
-          "address": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "as": Object {
-            "properties": Object {
-              "number": Object {
-                "type": "long",
-              },
-              "organization": Object {
-                "properties": Object {
-                  "name": Object {
-                    "fields": Object {
-                      "text": Object {
-                        "norms": false,
-                        "type": "text",
+        "destination": Object {
+          "properties": Object {
+            "address": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "as": Object {
+              "properties": Object {
+                "number": Object {
+                  "type": "long",
+                },
+                "organization": Object {
+                  "properties": Object {
+                    "name": Object {
+                      "fields": Object {
+                        "text": Object {
+                          "norms": false,
+                          "type": "text",
+                        },
                       },
+                      "ignore_above": 1024,
+                      "type": "keyword",
                     },
-                    "ignore_above": 1024,
-                    "type": "keyword",
                   },
                 },
               },
             },
-          },
-          "bytes": Object {
-            "type": "long",
-          },
-          "domain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "geo": Object {
-            "properties": Object {
-              "city_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "continent_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "continent_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "country_iso_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "country_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "location": Object {
-                "type": "geo_point",
-              },
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "postal_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "region_iso_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "region_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "timezone": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
+            "bytes": Object {
+              "type": "long",
             },
-          },
-          "ip": Object {
-            "type": "ip",
-          },
-          "mac": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "nat": Object {
-            "properties": Object {
-              "ip": Object {
-                "type": "ip",
-              },
-              "port": Object {
-                "type": "long",
-              },
+            "domain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-          },
-          "packets": Object {
-            "type": "long",
-          },
-          "port": Object {
-            "type": "long",
-          },
-          "registered_domain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "subdomain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "top_level_domain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "user": Object {
-            "properties": Object {
-              "domain": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "email": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            "geo": Object {
+              "properties": Object {
+                "city_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "continent_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "continent_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "country_iso_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "country_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "location": Object {
+                  "type": "geo_point",
+                },
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "postal_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "region_iso_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "region_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "timezone": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
-              "full_name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
-                  },
+            },
+            "ip": Object {
+              "type": "ip",
+            },
+            "mac": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "nat": Object {
+              "properties": Object {
+                "ip": Object {
+                  "type": "ip",
+                },
+                "port": Object {
+                  "type": "long",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
               },
-              "group": Object {
-                "properties": Object {
-                  "domain": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "id": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+            },
+            "packets": Object {
+              "type": "long",
+            },
+            "port": Object {
+              "type": "long",
+            },
+            "registered_domain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "subdomain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "top_level_domain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "user": Object {
+              "properties": Object {
+                "domain": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "email": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "full_name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
-                  "name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "group": Object {
+                  "properties": Object {
+                    "domain": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "id": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
-              },
-              "hash": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
+                "hash": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "roles": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "roles": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
               },
             },
           },
         },
-      },
-      "dll": Object {
-        "properties": Object {
-          "code_signature": Object {
-            "properties": Object {
-              "exists": Object {
-                "type": "boolean",
-              },
-              "signing_id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "status": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "subject_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "team_id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "trusted": Object {
-                "type": "boolean",
-              },
-              "valid": Object {
-                "type": "boolean",
+        "dll": Object {
+          "properties": Object {
+            "code_signature": Object {
+              "properties": Object {
+                "exists": Object {
+                  "type": "boolean",
+                },
+                "signing_id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "status": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "subject_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "team_id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "trusted": Object {
+                  "type": "boolean",
+                },
+                "valid": Object {
+                  "type": "boolean",
+                },
               },
             },
-          },
-          "hash": Object {
-            "properties": Object {
-              "md5": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "sha1": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "sha256": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "sha512": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "ssdeep": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            "hash": Object {
+              "properties": Object {
+                "md5": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "sha1": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "sha256": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "sha512": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "ssdeep": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
             },
-          },
-          "name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "path": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "pe": Object {
-            "properties": Object {
-              "architecture": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "company": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "description": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "file_version": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "imphash": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "original_file_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "product": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            "name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "path": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "pe": Object {
+              "properties": Object {
+                "architecture": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "company": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "description": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "file_version": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "imphash": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "original_file_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "product": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
             },
           },
         },
-      },
-      "dns": Object {
-        "properties": Object {
-          "answers": Object {
-            "properties": Object {
-              "class": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "data": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "ttl": Object {
-                "type": "long",
-              },
-              "type": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+        "dns": Object {
+          "properties": Object {
+            "answers": Object {
+              "properties": Object {
+                "class": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "data": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "ttl": Object {
+                  "type": "long",
+                },
+                "type": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
+              "type": "object",
             },
-            "type": "object",
-          },
-          "header_flags": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "op_code": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "question": Object {
-            "properties": Object {
-              "class": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "registered_domain": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "subdomain": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "top_level_domain": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "type": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            "header_flags": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "op_code": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "question": Object {
+              "properties": Object {
+                "class": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "registered_domain": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "subdomain": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "top_level_domain": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "type": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
             },
-          },
-          "resolved_ip": Object {
-            "type": "ip",
-          },
-          "response_code": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "type": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+            "resolved_ip": Object {
+              "type": "ip",
+            },
+            "response_code": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "type": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
         },
-      },
-      "ecs": Object {
-        "properties": Object {
-          "version": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+        "ecs": Object {
+          "properties": Object {
+            "version": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
         },
-      },
-      "error": Object {
-        "properties": Object {
-          "code": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "message": Object {
-            "norms": false,
-            "type": "text",
-          },
-          "stack_trace": Object {
-            "doc_values": false,
-            "fields": Object {
-              "text": Object {
-                "norms": false,
-                "type": "text",
+        "error": Object {
+          "properties": Object {
+            "code": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "message": Object {
+              "norms": false,
+              "type": "text",
+            },
+            "stack_trace": Object {
+              "doc_values": false,
+              "fields": Object {
+                "text": Object {
+                  "norms": false,
+                  "type": "text",
+                },
               },
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword",
+            },
+            "type": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-            "ignore_above": 1024,
-            "index": false,
-            "type": "keyword",
-          },
-          "type": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
           },
         },
-      },
-      "event": Object {
-        "properties": Object {
-          "action": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "category": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "code": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "created": Object {
-            "type": "date",
-          },
-          "dataset": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "duration": Object {
-            "type": "long",
-          },
-          "end": Object {
-            "type": "date",
-          },
-          "hash": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "ingested": Object {
-            "type": "date",
-          },
-          "kind": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "module": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "original": Object {
-            "doc_values": false,
-            "ignore_above": 1024,
-            "index": false,
-            "type": "keyword",
-          },
-          "outcome": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "provider": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "reason": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "reference": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "risk_score": Object {
-            "type": "float",
-          },
-          "risk_score_norm": Object {
-            "type": "float",
-          },
-          "sequence": Object {
-            "type": "long",
-          },
-          "severity": Object {
-            "type": "long",
-          },
-          "start": Object {
-            "type": "date",
-          },
-          "timezone": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "type": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "url": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+        "event": Object {
+          "properties": Object {
+            "action": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "category": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "code": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "created": Object {
+              "type": "date",
+            },
+            "dataset": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "duration": Object {
+              "type": "long",
+            },
+            "end": Object {
+              "type": "date",
+            },
+            "hash": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "ingested": Object {
+              "type": "date",
+            },
+            "kind": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "module": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "original": Object {
+              "doc_values": false,
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword",
+            },
+            "outcome": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "provider": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "reason": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "reference": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "risk_score": Object {
+              "type": "float",
+            },
+            "risk_score_norm": Object {
+              "type": "float",
+            },
+            "sequence": Object {
+              "type": "long",
+            },
+            "severity": Object {
+              "type": "long",
+            },
+            "start": Object {
+              "type": "date",
+            },
+            "timezone": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "type": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "url": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
         },
-      },
-      "file": Object {
-        "properties": Object {
-          "accessed": Object {
-            "type": "date",
-          },
-          "attributes": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "code_signature": Object {
-            "properties": Object {
-              "exists": Object {
-                "type": "boolean",
-              },
-              "signing_id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "status": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "subject_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "team_id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "trusted": Object {
-                "type": "boolean",
-              },
-              "valid": Object {
-                "type": "boolean",
-              },
+        "file": Object {
+          "properties": Object {
+            "accessed": Object {
+              "type": "date",
             },
-          },
-          "created": Object {
-            "type": "date",
-          },
-          "ctime": Object {
-            "type": "date",
-          },
-          "device": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "directory": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "drive_letter": Object {
-            "ignore_above": 1,
-            "type": "keyword",
-          },
-          "extension": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "gid": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "group": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "hash": Object {
-            "properties": Object {
-              "md5": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "sha1": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "sha256": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "sha512": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "ssdeep": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
+            "attributes": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-          },
-          "inode": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "mime_type": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "mode": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "mtime": Object {
-            "type": "date",
-          },
-          "name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "owner": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "path": Object {
-            "fields": Object {
-              "text": Object {
-                "norms": false,
-                "type": "text",
+            "code_signature": Object {
+              "properties": Object {
+                "exists": Object {
+                  "type": "boolean",
+                },
+                "signing_id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "status": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "subject_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "team_id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "trusted": Object {
+                  "type": "boolean",
+                },
+                "valid": Object {
+                  "type": "boolean",
+                },
               },
             },
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "pe": Object {
-            "properties": Object {
-              "architecture": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "company": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "description": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            "created": Object {
+              "type": "date",
+            },
+            "ctime": Object {
+              "type": "date",
+            },
+            "device": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "directory": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "drive_letter": Object {
+              "ignore_above": 1,
+              "type": "keyword",
+            },
+            "extension": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "gid": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "group": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "hash": Object {
+              "properties": Object {
+                "md5": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "sha1": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "sha256": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "sha512": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "ssdeep": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
-              "file_version": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            },
+            "inode": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "mime_type": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "mode": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "mtime": Object {
+              "type": "date",
+            },
+            "name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "owner": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "path": Object {
+              "fields": Object {
+                "text": Object {
+                  "norms": false,
+                  "type": "text",
+                },
               },
-              "imphash": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "pe": Object {
+              "properties": Object {
+                "architecture": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "company": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "description": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "file_version": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "imphash": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "original_file_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "product": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
-              "original_file_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            },
+            "size": Object {
+              "type": "long",
+            },
+            "target_path": Object {
+              "fields": Object {
+                "text": Object {
+                  "norms": false,
+                  "type": "text",
+                },
               },
-              "product": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "type": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "uid": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "x509": Object {
+              "properties": Object {
+                "alternative_names": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "issuer": Object {
+                  "properties": Object {
+                    "common_name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "country": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "distinguished_name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "locality": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "organization": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "organizational_unit": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "state_or_province": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                  },
+                },
+                "not_after": Object {
+                  "type": "date",
+                },
+                "not_before": Object {
+                  "type": "date",
+                },
+                "public_key_algorithm": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "public_key_curve": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "public_key_exponent": Object {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "long",
+                },
+                "public_key_size": Object {
+                  "type": "long",
+                },
+                "serial_number": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "signature_algorithm": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "subject": Object {
+                  "properties": Object {
+                    "common_name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "country": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "distinguished_name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "locality": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "organization": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "organizational_unit": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "state_or_province": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                  },
+                },
+                "version_number": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
             },
           },
-          "size": Object {
-            "type": "long",
-          },
-          "target_path": Object {
-            "fields": Object {
-              "text": Object {
-                "norms": false,
-                "type": "text",
-              },
+        },
+        "geo": Object {
+          "properties": Object {
+            "city_name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "continent_name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "country_iso_code": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "country_name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "location": Object {
+              "type": "geo_point",
+            },
+            "name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "region_iso_code": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "region_name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-            "ignore_above": 1024,
-            "type": "keyword",
           },
-          "type": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+        },
+        "group": Object {
+          "properties": Object {
+            "domain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
-          "uid": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+        },
+        "hash": Object {
+          "properties": Object {
+            "md5": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "sha1": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "sha256": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "sha512": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
-          "x509": Object {
-            "properties": Object {
-              "alternative_names": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+        },
+        "host": Object {
+          "properties": Object {
+            "architecture": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "cpu": Object {
+              "properties": Object {
+                "usage": Object {
+                  "scaling_factor": 1000,
+                  "type": "scaled_float",
+                },
               },
-              "issuer": Object {
-                "properties": Object {
-                  "common_name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "country": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "distinguished_name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "locality": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "organization": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "organizational_unit": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+            },
+            "disk": Object {
+              "properties": Object {
+                "read": Object {
+                  "properties": Object {
+                    "bytes": Object {
+                      "type": "long",
+                    },
                   },
-                  "state_or_province": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                },
+                "write": Object {
+                  "properties": Object {
+                    "bytes": Object {
+                      "type": "long",
+                    },
                   },
                 },
               },
-              "not_after": Object {
-                "type": "date",
-              },
-              "not_before": Object {
-                "type": "date",
-              },
-              "public_key_algorithm": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "public_key_curve": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "public_key_exponent": Object {
-                "doc_values": false,
-                "index": false,
-                "type": "long",
-              },
-              "public_key_size": Object {
-                "type": "long",
-              },
-              "serial_number": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "signature_algorithm": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            },
+            "domain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "geo": Object {
+              "properties": Object {
+                "city_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "continent_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "continent_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "country_iso_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "country_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "location": Object {
+                  "type": "geo_point",
+                },
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "postal_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "region_iso_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "region_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "timezone": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
-              "subject": Object {
-                "properties": Object {
-                  "common_name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+            },
+            "hostname": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "ip": Object {
+              "type": "ip",
+            },
+            "mac": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "network": Object {
+              "properties": Object {
+                "egress": Object {
+                  "properties": Object {
+                    "bytes": Object {
+                      "type": "long",
+                    },
+                    "packets": Object {
+                      "type": "long",
+                    },
                   },
-                  "country": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                },
+                "ingress": Object {
+                  "properties": Object {
+                    "bytes": Object {
+                      "type": "long",
+                    },
+                    "packets": Object {
+                      "type": "long",
+                    },
                   },
-                  "distinguished_name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                },
+              },
+            },
+            "os": Object {
+              "properties": Object {
+                "family": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "full": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
-                  "locality": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "kernel": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
-                  "organization": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "platform": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "type": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "version": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+              },
+            },
+            "type": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "uptime": Object {
+              "type": "long",
+            },
+            "user": Object {
+              "properties": Object {
+                "domain": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "email": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "full_name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
-                  "organizational_unit": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "group": Object {
+                  "properties": Object {
+                    "domain": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "id": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
-                  "state_or_province": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                },
+                "hash": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "roles": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-              },
-              "version_number": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
               },
             },
           },
         },
-      },
-      "geo": Object {
-        "properties": Object {
-          "city_name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "continent_name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "country_iso_code": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "country_name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "location": Object {
-            "type": "geo_point",
-          },
-          "name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "region_iso_code": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "region_name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-        },
-      },
-      "group": Object {
-        "properties": Object {
-          "domain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-        },
-      },
-      "hash": Object {
-        "properties": Object {
-          "md5": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "sha1": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "sha256": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "sha512": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-        },
-      },
-      "host": Object {
-        "properties": Object {
-          "architecture": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "cpu": Object {
-            "properties": Object {
-              "usage": Object {
-                "scaling_factor": 1000,
-                "type": "scaled_float",
-              },
-            },
-          },
-          "disk": Object {
-            "properties": Object {
-              "read": Object {
-                "properties": Object {
-                  "bytes": Object {
-                    "type": "long",
+        "http": Object {
+          "properties": Object {
+            "request": Object {
+              "properties": Object {
+                "body": Object {
+                  "properties": Object {
+                    "bytes": Object {
+                      "type": "long",
+                    },
+                    "content": Object {
+                      "fields": Object {
+                        "text": Object {
+                          "norms": false,
+                          "type": "text",
+                        },
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
+                "bytes": Object {
+                  "type": "long",
+                },
+                "id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "method": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "mime_type": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "referrer": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
-              "write": Object {
-                "properties": Object {
-                  "bytes": Object {
-                    "type": "long",
+            },
+            "response": Object {
+              "properties": Object {
+                "body": Object {
+                  "properties": Object {
+                    "bytes": Object {
+                      "type": "long",
+                    },
+                    "content": Object {
+                      "fields": Object {
+                        "text": Object {
+                          "norms": false,
+                          "type": "text",
+                        },
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
+                "bytes": Object {
+                  "type": "long",
+                },
+                "mime_type": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "status_code": Object {
+                  "type": "long",
+                },
               },
             },
-          },
-          "domain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "geo": Object {
-            "properties": Object {
-              "city_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "continent_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "continent_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "country_iso_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "country_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "location": Object {
-                "type": "geo_point",
-              },
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "postal_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "region_iso_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "region_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "timezone": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
+            "version": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
           },
-          "hostname": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "ip": Object {
-            "type": "ip",
-          },
-          "mac": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+        },
+        "interface": Object {
+          "properties": Object {
+            "alias": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
-          "network": Object {
-            "properties": Object {
-              "egress": Object {
-                "properties": Object {
-                  "bytes": Object {
-                    "type": "long",
-                  },
-                  "packets": Object {
-                    "type": "long",
-                  },
-                },
-              },
-              "ingress": Object {
-                "properties": Object {
-                  "bytes": Object {
-                    "type": "long",
-                  },
-                  "packets": Object {
-                    "type": "long",
-                  },
+        },
+        "kibana.alert.ancestors.depth": Object {
+          "path": "signal.ancestors.depth",
+          "type": "alias",
+        },
+        "kibana.alert.ancestors.id": Object {
+          "path": "signal.ancestors.id",
+          "type": "alias",
+        },
+        "kibana.alert.ancestors.index": Object {
+          "path": "signal.ancestors.index",
+          "type": "alias",
+        },
+        "kibana.alert.ancestors.type": Object {
+          "path": "signal.ancestors.type",
+          "type": "alias",
+        },
+        "kibana.alert.consumers": Object {
+          "type": "constant_keyword",
+          "value": "siem",
+        },
+        "kibana.alert.depth": Object {
+          "path": "signal.depth",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.action": Object {
+          "path": "signal.original_event.action",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.category": Object {
+          "path": "signal.original_event.category",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.code": Object {
+          "path": "signal.original_event.code",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.created": Object {
+          "path": "signal.original_event.created",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.dataset": Object {
+          "path": "signal.original_event.dataset",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.duration": Object {
+          "path": "signal.original_event.duration",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.end": Object {
+          "path": "signal.original_event.end",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.hash": Object {
+          "path": "signal.original_event.hash",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.id": Object {
+          "path": "signal.original_event.id",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.kind": Object {
+          "path": "signal.original_event.kind",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.module": Object {
+          "path": "signal.original_event.module",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.outcome": Object {
+          "path": "signal.original_event.outcome",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.provider": Object {
+          "path": "signal.original_event.provider",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.risk_score": Object {
+          "path": "signal.original_event.risk_score",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.risk_score_norm": Object {
+          "path": "signal.original_event.risk_score_norm",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.sequence": Object {
+          "path": "signal.original_event.sequence",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.severity": Object {
+          "path": "signal.original_event.severity",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.start": Object {
+          "path": "signal.original_event.start",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.timezone": Object {
+          "path": "signal.original_event.timezone",
+          "type": "alias",
+        },
+        "kibana.alert.original_event.type": Object {
+          "path": "signal.original_event.type",
+          "type": "alias",
+        },
+        "kibana.alert.original_time": Object {
+          "path": "signal.original_time",
+          "type": "alias",
+        },
+        "kibana.alert.producer": Object {
+          "type": "constant_keyword",
+          "value": "siem",
+        },
+        "kibana.alert.risk_score": Object {
+          "path": "signal.rule.risk_score",
+          "type": "alias",
+        },
+        "kibana.alert.rule.author": Object {
+          "path": "signal.rule.author",
+          "type": "alias",
+        },
+        "kibana.alert.rule.building_block_type": Object {
+          "path": "signal.rule.building_block_type",
+          "type": "alias",
+        },
+        "kibana.alert.rule.created_at": Object {
+          "path": "signal.rule.created_at",
+          "type": "alias",
+        },
+        "kibana.alert.rule.created_by": Object {
+          "path": "signal.rule.created_by",
+          "type": "alias",
+        },
+        "kibana.alert.rule.description": Object {
+          "path": "signal.rule.description",
+          "type": "alias",
+        },
+        "kibana.alert.rule.enabled": Object {
+          "path": "signal.rule.enabled",
+          "type": "alias",
+        },
+        "kibana.alert.rule.false_positives": Object {
+          "path": "signal.rule.false_positives",
+          "type": "alias",
+        },
+        "kibana.alert.rule.from": Object {
+          "path": "signal.rule.from",
+          "type": "alias",
+        },
+        "kibana.alert.rule.id": Object {
+          "path": "signal.rule.id",
+          "type": "alias",
+        },
+        "kibana.alert.rule.immutable": Object {
+          "path": "signal.rule.immutable",
+          "type": "alias",
+        },
+        "kibana.alert.rule.index": Object {
+          "path": "signal.rule.index",
+          "type": "alias",
+        },
+        "kibana.alert.rule.interval": Object {
+          "path": "signal.rule.interval",
+          "type": "alias",
+        },
+        "kibana.alert.rule.language": Object {
+          "path": "signal.rule.language",
+          "type": "alias",
+        },
+        "kibana.alert.rule.license": Object {
+          "path": "signal.rule.license",
+          "type": "alias",
+        },
+        "kibana.alert.rule.max_signals": Object {
+          "path": "signal.rule.max_signals",
+          "type": "alias",
+        },
+        "kibana.alert.rule.name": Object {
+          "path": "signal.rule.name",
+          "type": "alias",
+        },
+        "kibana.alert.rule.note": Object {
+          "path": "signal.rule.note",
+          "type": "alias",
+        },
+        "kibana.alert.rule.query": Object {
+          "path": "signal.rule.query",
+          "type": "alias",
+        },
+        "kibana.alert.rule.references": Object {
+          "path": "signal.rule.references",
+          "type": "alias",
+        },
+        "kibana.alert.rule.risk_score_mapping.field": Object {
+          "path": "signal.rule.risk_score_mapping.field",
+          "type": "alias",
+        },
+        "kibana.alert.rule.risk_score_mapping.operator": Object {
+          "path": "signal.rule.risk_score_mapping.operator",
+          "type": "alias",
+        },
+        "kibana.alert.rule.risk_score_mapping.value": Object {
+          "path": "signal.rule.risk_score_mapping.value",
+          "type": "alias",
+        },
+        "kibana.alert.rule.rule_id": Object {
+          "path": "signal.rule.rule_id",
+          "type": "alias",
+        },
+        "kibana.alert.rule.rule_name_override": Object {
+          "path": "signal.rule.rule_name_override",
+          "type": "alias",
+        },
+        "kibana.alert.rule.rule_type_id": Object {
+          "type": "constant_keyword",
+          "value": "siem.signals",
+        },
+        "kibana.alert.rule.saved_id": Object {
+          "path": "signal.rule.saved_id",
+          "type": "alias",
+        },
+        "kibana.alert.rule.severity_mapping.field": Object {
+          "path": "signal.rule.severity_mapping.field",
+          "type": "alias",
+        },
+        "kibana.alert.rule.severity_mapping.operator": Object {
+          "path": "signal.rule.severity_mapping.operator",
+          "type": "alias",
+        },
+        "kibana.alert.rule.severity_mapping.severity": Object {
+          "path": "signal.rule.severity_mapping.severity",
+          "type": "alias",
+        },
+        "kibana.alert.rule.severity_mapping.value": Object {
+          "path": "signal.rule.severity_mapping.value",
+          "type": "alias",
+        },
+        "kibana.alert.rule.tags": Object {
+          "path": "signal.rule.tags",
+          "type": "alias",
+        },
+        "kibana.alert.rule.threat.framework": Object {
+          "path": "signal.rule.threat.framework",
+          "type": "alias",
+        },
+        "kibana.alert.rule.threat.tactic.id": Object {
+          "path": "signal.rule.threat.tactic.id",
+          "type": "alias",
+        },
+        "kibana.alert.rule.threat.tactic.name": Object {
+          "path": "signal.rule.threat.tactic.name",
+          "type": "alias",
+        },
+        "kibana.alert.rule.threat.tactic.reference": Object {
+          "path": "signal.rule.threat.tactic.reference",
+          "type": "alias",
+        },
+        "kibana.alert.rule.threat.technique.id": Object {
+          "path": "signal.rule.threat.technique.id",
+          "type": "alias",
+        },
+        "kibana.alert.rule.threat.technique.name": Object {
+          "path": "signal.rule.threat.technique.name",
+          "type": "alias",
+        },
+        "kibana.alert.rule.threat.technique.reference": Object {
+          "path": "signal.rule.threat.technique.reference",
+          "type": "alias",
+        },
+        "kibana.alert.rule.threat.technique.subtechnique.id": Object {
+          "path": "signal.rule.threat.technique.subtechnique.id",
+          "type": "alias",
+        },
+        "kibana.alert.rule.threat.technique.subtechnique.name": Object {
+          "path": "signal.rule.threat.technique.subtechnique.name",
+          "type": "alias",
+        },
+        "kibana.alert.rule.threat.technique.subtechnique.reference": Object {
+          "path": "signal.rule.threat.technique.subtechnique.reference",
+          "type": "alias",
+        },
+        "kibana.alert.rule.threat_index": Object {
+          "path": "signal.rule.threat_index",
+          "type": "alias",
+        },
+        "kibana.alert.rule.threat_indicator_path": Object {
+          "path": "signal.rule.threat_indicator_path",
+          "type": "alias",
+        },
+        "kibana.alert.rule.threat_language": Object {
+          "path": "signal.rule.threat_language",
+          "type": "alias",
+        },
+        "kibana.alert.rule.threat_mapping.entries.field": Object {
+          "path": "signal.rule.threat_mapping.entries.field",
+          "type": "alias",
+        },
+        "kibana.alert.rule.threat_mapping.entries.type": Object {
+          "path": "signal.rule.threat_mapping.entries.type",
+          "type": "alias",
+        },
+        "kibana.alert.rule.threat_mapping.entries.value": Object {
+          "path": "signal.rule.threat_mapping.entries.value",
+          "type": "alias",
+        },
+        "kibana.alert.rule.threat_query": Object {
+          "path": "signal.rule.threat_query",
+          "type": "alias",
+        },
+        "kibana.alert.rule.threshold.field": Object {
+          "path": "signal.rule.threshold.field",
+          "type": "alias",
+        },
+        "kibana.alert.rule.threshold.value": Object {
+          "path": "signal.rule.threshold.value",
+          "type": "alias",
+        },
+        "kibana.alert.rule.timeline_id": Object {
+          "path": "signal.rule.timeline_id",
+          "type": "alias",
+        },
+        "kibana.alert.rule.timeline_title": Object {
+          "path": "signal.rule.timeline_title",
+          "type": "alias",
+        },
+        "kibana.alert.rule.to": Object {
+          "path": "signal.rule.to",
+          "type": "alias",
+        },
+        "kibana.alert.rule.type": Object {
+          "path": "signal.rule.type",
+          "type": "alias",
+        },
+        "kibana.alert.rule.updated_at": Object {
+          "path": "signal.rule.updated_at",
+          "type": "alias",
+        },
+        "kibana.alert.rule.updated_by": Object {
+          "path": "signal.rule.updated_by",
+          "type": "alias",
+        },
+        "kibana.alert.rule.version": Object {
+          "path": "signal.rule.version",
+          "type": "alias",
+        },
+        "kibana.alert.severity": Object {
+          "path": "signal.rule.severity",
+          "type": "alias",
+        },
+        "kibana.alert.threshold_result.cardinality.field": Object {
+          "path": "signal.threshold_result.cardinality.field",
+          "type": "alias",
+        },
+        "kibana.alert.threshold_result.cardinality.value": Object {
+          "path": "signal.threshold_result.cardinality.value",
+          "type": "alias",
+        },
+        "kibana.alert.threshold_result.count": Object {
+          "path": "signal.threshold_result.count",
+          "type": "alias",
+        },
+        "kibana.alert.threshold_result.from": Object {
+          "path": "signal.threshold_result.from",
+          "type": "alias",
+        },
+        "kibana.alert.threshold_result.terms.field": Object {
+          "path": "signal.threshold_result.terms.field",
+          "type": "alias",
+        },
+        "kibana.alert.threshold_result.terms.value": Object {
+          "path": "signal.threshold_result.terms.value",
+          "type": "alias",
+        },
+        "kibana.alert.workflow_status": Object {
+          "path": "signal.status",
+          "type": "alias",
+        },
+        "kibana.space_ids": Object {
+          "type": "constant_keyword",
+          "value": "space-id",
+        },
+        "labels": Object {
+          "type": "object",
+        },
+        "log": Object {
+          "properties": Object {
+            "file": Object {
+              "properties": Object {
+                "path": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
               },
             },
-          },
-          "os": Object {
-            "properties": Object {
-              "family": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "full": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
+            "level": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "logger": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "origin": Object {
+              "properties": Object {
+                "file": Object {
+                  "properties": Object {
+                    "line": Object {
+                      "type": "integer",
+                    },
+                    "name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "kernel": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
-                  },
+                "function": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "platform": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "type": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "version": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
               },
             },
-          },
-          "type": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "uptime": Object {
-            "type": "long",
-          },
-          "user": Object {
-            "properties": Object {
-              "domain": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "email": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "full_name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
+            "original": Object {
+              "doc_values": false,
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword",
+            },
+            "syslog": Object {
+              "properties": Object {
+                "facility": Object {
+                  "properties": Object {
+                    "code": Object {
+                      "type": "long",
+                    },
+                    "name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "group": Object {
-                "properties": Object {
-                  "domain": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "id": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
+                "priority": Object {
+                  "type": "long",
                 },
-              },
-              "hash": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
+                "severity": Object {
+                  "properties": Object {
+                    "code": Object {
+                      "type": "long",
+                    },
+                    "name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "roles": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
               },
+              "type": "object",
             },
           },
         },
-      },
-      "http": Object {
-        "properties": Object {
-          "request": Object {
-            "properties": Object {
-              "body": Object {
-                "properties": Object {
-                  "bytes": Object {
-                    "type": "long",
-                  },
-                  "content": Object {
-                    "fields": Object {
-                      "text": Object {
-                        "norms": false,
-                        "type": "text",
-                      },
+        "message": Object {
+          "norms": false,
+          "type": "text",
+        },
+        "network": Object {
+          "properties": Object {
+            "application": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "bytes": Object {
+              "type": "long",
+            },
+            "community_id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "direction": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "forwarded_ip": Object {
+              "type": "ip",
+            },
+            "iana_number": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "inner": Object {
+              "properties": Object {
+                "vlan": Object {
+                  "properties": Object {
+                    "id": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
                     },
-                    "ignore_above": 1024,
-                    "type": "keyword",
                   },
                 },
               },
-              "bytes": Object {
-                "type": "long",
-              },
-              "id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "method": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "mime_type": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "referrer": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
+              "type": "object",
             },
-          },
-          "response": Object {
-            "properties": Object {
-              "body": Object {
-                "properties": Object {
-                  "bytes": Object {
-                    "type": "long",
-                  },
-                  "content": Object {
-                    "fields": Object {
-                      "text": Object {
-                        "norms": false,
-                        "type": "text",
-                      },
-                    },
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
+            "name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "packets": Object {
+              "type": "long",
+            },
+            "protocol": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "transport": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "type": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "vlan": Object {
+              "properties": Object {
+                "id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-              },
-              "bytes": Object {
-                "type": "long",
-              },
-              "mime_type": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "status_code": Object {
-                "type": "long",
               },
             },
           },
-          "version": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-        },
-      },
-      "interface": Object {
-        "properties": Object {
-          "alias": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
         },
-      },
-      "labels": Object {
-        "type": "object",
-      },
-      "log": Object {
-        "properties": Object {
-          "file": Object {
-            "properties": Object {
-              "path": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-            },
-          },
-          "level": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "logger": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "origin": Object {
-            "properties": Object {
-              "file": Object {
-                "properties": Object {
-                  "line": Object {
-                    "type": "integer",
+        "observer": Object {
+          "properties": Object {
+            "egress": Object {
+              "properties": Object {
+                "interface": Object {
+                  "properties": Object {
+                    "alias": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "id": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
-                  "name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                },
+                "vlan": Object {
+                  "properties": Object {
+                    "id": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
+                "zone": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
-              "function": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
+              "type": "object",
             },
-          },
-          "original": Object {
-            "doc_values": false,
-            "ignore_above": 1024,
-            "index": false,
-            "type": "keyword",
-          },
-          "syslog": Object {
-            "properties": Object {
-              "facility": Object {
-                "properties": Object {
-                  "code": Object {
-                    "type": "long",
-                  },
-                  "name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
+            "geo": Object {
+              "properties": Object {
+                "city_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-              },
-              "priority": Object {
-                "type": "long",
-              },
-              "severity": Object {
-                "properties": Object {
-                  "code": Object {
-                    "type": "long",
-                  },
-                  "name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
+                "continent_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "continent_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "country_iso_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "country_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "location": Object {
+                  "type": "geo_point",
+                },
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "postal_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "region_iso_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "region_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "timezone": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
               },
             },
-            "type": "object",
-          },
-        },
-      },
-      "message": Object {
-        "norms": false,
-        "type": "text",
-      },
-      "network": Object {
-        "properties": Object {
-          "application": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "bytes": Object {
-            "type": "long",
-          },
-          "community_id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "direction": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "forwarded_ip": Object {
-            "type": "ip",
-          },
-          "iana_number": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "inner": Object {
-            "properties": Object {
-              "vlan": Object {
-                "properties": Object {
-                  "id": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+            "hostname": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "ingress": Object {
+              "properties": Object {
+                "interface": Object {
+                  "properties": Object {
+                    "alias": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "id": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
-                  "name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                },
+                "vlan": Object {
+                  "properties": Object {
+                    "id": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
+                "zone": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
+              "type": "object",
             },
-            "type": "object",
-          },
-          "name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "packets": Object {
-            "type": "long",
-          },
-          "protocol": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "transport": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "type": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "vlan": Object {
-            "properties": Object {
-              "id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
+            "ip": Object {
+              "type": "ip",
             },
-          },
-        },
-      },
-      "observer": Object {
-        "properties": Object {
-          "egress": Object {
-            "properties": Object {
-              "interface": Object {
-                "properties": Object {
-                  "alias": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "id": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
+            "mac": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "os": Object {
+              "properties": Object {
+                "family": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-              },
-              "vlan": Object {
-                "properties": Object {
-                  "id": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                "full": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
-                  "name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "kernel": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "platform": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "type": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "version": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-              },
-              "zone": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
               },
             },
-            "type": "object",
-          },
-          "geo": Object {
-            "properties": Object {
-              "city_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "continent_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "continent_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "country_iso_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "country_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "location": Object {
-                "type": "geo_point",
-              },
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "postal_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "region_iso_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "region_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "timezone": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
+            "product": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "serial_number": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "type": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "vendor": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "version": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
           },
-          "hostname": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "ingress": Object {
-            "properties": Object {
-              "interface": Object {
-                "properties": Object {
-                  "alias": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "id": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
+        },
+        "orchestrator": Object {
+          "properties": Object {
+            "api_version": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "cluster": Object {
+              "properties": Object {
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-              },
-              "vlan": Object {
-                "properties": Object {
-                  "id": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
+                "url": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "version": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-              },
-              "zone": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
               },
             },
-            "type": "object",
-          },
-          "ip": Object {
-            "type": "ip",
-          },
-          "mac": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "os": Object {
-            "properties": Object {
-              "family": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "full": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
-                  },
+            "namespace": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "organization": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "resource": Object {
+              "properties": Object {
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "kernel": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
-                  },
+                "type": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "platform": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "type": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "version": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
               },
             },
-          },
-          "product": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "serial_number": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "type": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "vendor": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "version": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+            "type": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
         },
-      },
-      "orchestrator": Object {
-        "properties": Object {
-          "api_version": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "cluster": Object {
-            "properties": Object {
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "url": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "version": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
+        "organization": Object {
+          "properties": Object {
+            "id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-          },
-          "namespace": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "organization": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "resource": Object {
-            "properties": Object {
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "type": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            "name": Object {
+              "fields": Object {
+                "text": Object {
+                  "norms": false,
+                  "type": "text",
+                },
               },
+              "ignore_above": 1024,
+              "type": "keyword",
             },
           },
-          "type": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
         },
-      },
-      "organization": Object {
-        "properties": Object {
-          "id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "name": Object {
-            "fields": Object {
-              "text": Object {
-                "norms": false,
-                "type": "text",
-              },
+        "os": Object {
+          "properties": Object {
+            "family": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-        },
-      },
-      "os": Object {
-        "properties": Object {
-          "family": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "full": Object {
-            "fields": Object {
-              "text": Object {
-                "norms": false,
-                "type": "text",
+            "full": Object {
+              "fields": Object {
+                "text": Object {
+                  "norms": false,
+                  "type": "text",
+                },
               },
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "kernel": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "name": Object {
-            "fields": Object {
-              "text": Object {
-                "norms": false,
-                "type": "text",
+            "kernel": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "name": Object {
+              "fields": Object {
+                "text": Object {
+                  "norms": false,
+                  "type": "text",
+                },
               },
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "platform": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "version": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "platform": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "version": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-        },
-      },
-      "package": Object {
-        "properties": Object {
-          "architecture": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "build_version": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "checksum": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "description": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "install_scope": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "installed": Object {
-            "type": "date",
-          },
-          "license": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "path": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "reference": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "size": Object {
-            "type": "long",
-          },
-          "type": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "version": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
           },
         },
-      },
-      "pe": Object {
-        "properties": Object {
-          "company": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "description": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "file_version": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "original_file_name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "product": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+        "package": Object {
+          "properties": Object {
+            "architecture": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "build_version": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "checksum": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "description": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "install_scope": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "installed": Object {
+              "type": "date",
+            },
+            "license": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "path": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "reference": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "size": Object {
+              "type": "long",
+            },
+            "type": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "version": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
         },
-      },
-      "process": Object {
-        "properties": Object {
-          "args": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "args_count": Object {
-            "type": "long",
-          },
-          "code_signature": Object {
-            "properties": Object {
-              "exists": Object {
-                "type": "boolean",
-              },
-              "signing_id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "status": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "subject_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "team_id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "trusted": Object {
-                "type": "boolean",
-              },
-              "valid": Object {
-                "type": "boolean",
-              },
+        "pe": Object {
+          "properties": Object {
+            "company": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-          },
-          "command_line": Object {
-            "fields": Object {
-              "text": Object {
-                "norms": false,
-                "type": "text",
-              },
+            "description": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "entity_id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "executable": Object {
-            "fields": Object {
-              "text": Object {
-                "norms": false,
-                "type": "text",
-              },
+            "file_version": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "exit_code": Object {
-            "type": "long",
-          },
-          "hash": Object {
-            "properties": Object {
-              "md5": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "sha1": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "sha256": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "sha512": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "ssdeep": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
+            "original_file_name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-          },
-          "name": Object {
-            "fields": Object {
-              "text": Object {
-                "norms": false,
-                "type": "text",
-              },
+            "product": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-            "ignore_above": 1024,
-            "type": "keyword",
           },
-          "parent": Object {
-            "properties": Object {
-              "args": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "args_count": Object {
-                "type": "long",
-              },
-              "code_signature": Object {
-                "properties": Object {
-                  "exists": Object {
-                    "type": "boolean",
-                  },
-                  "signing_id": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "status": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "subject_name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "team_id": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "trusted": Object {
-                    "type": "boolean",
-                  },
-                  "valid": Object {
-                    "type": "boolean",
-                  },
+        },
+        "process": Object {
+          "properties": Object {
+            "args": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "args_count": Object {
+              "type": "long",
+            },
+            "code_signature": Object {
+              "properties": Object {
+                "exists": Object {
+                  "type": "boolean",
                 },
-              },
-              "command_line": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
-                  },
+                "signing_id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "status": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "subject_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "team_id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "trusted": Object {
+                  "type": "boolean",
+                },
+                "valid": Object {
+                  "type": "boolean",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "entity_id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
               },
-              "executable": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
-                  },
+            },
+            "command_line": Object {
+              "fields": Object {
+                "text": Object {
+                  "norms": false,
+                  "type": "text",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
               },
-              "exit_code": Object {
-                "type": "long",
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "entity_id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "executable": Object {
+              "fields": Object {
+                "text": Object {
+                  "norms": false,
+                  "type": "text",
+                },
               },
-              "hash": Object {
-                "properties": Object {
-                  "md5": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "sha1": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "sha256": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "sha512": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "ssdeep": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "exit_code": Object {
+              "type": "long",
+            },
+            "hash": Object {
+              "properties": Object {
+                "md5": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "sha1": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "sha256": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "sha512": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "ssdeep": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
               },
-              "name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
-                  },
+            },
+            "name": Object {
+              "fields": Object {
+                "text": Object {
+                  "norms": false,
+                  "type": "text",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
               },
-              "pe": Object {
-                "properties": Object {
-                  "architecture": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "company": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "description": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "parent": Object {
+              "properties": Object {
+                "args": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "args_count": Object {
+                  "type": "long",
+                },
+                "code_signature": Object {
+                  "properties": Object {
+                    "exists": Object {
+                      "type": "boolean",
+                    },
+                    "signing_id": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "status": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "subject_name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "team_id": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "trusted": Object {
+                      "type": "boolean",
+                    },
+                    "valid": Object {
+                      "type": "boolean",
+                    },
                   },
-                  "file_version": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                },
+                "command_line": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
-                  "imphash": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "entity_id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "executable": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
-                  "original_file_name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "exit_code": Object {
+                  "type": "long",
+                },
+                "hash": Object {
+                  "properties": Object {
+                    "md5": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "sha1": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "sha256": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "sha512": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "ssdeep": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
-                  "product": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                },
+                "name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-              },
-              "pgid": Object {
-                "type": "long",
-              },
-              "pid": Object {
-                "type": "long",
-              },
-              "ppid": Object {
-                "type": "long",
-              },
-              "start": Object {
-                "type": "date",
-              },
-              "thread": Object {
-                "properties": Object {
-                  "id": Object {
-                    "type": "long",
+                "pe": Object {
+                  "properties": Object {
+                    "architecture": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "company": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "description": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "file_version": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "imphash": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "original_file_name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "product": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
-                  "name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                },
+                "pgid": Object {
+                  "type": "long",
+                },
+                "pid": Object {
+                  "type": "long",
+                },
+                "ppid": Object {
+                  "type": "long",
+                },
+                "start": Object {
+                  "type": "date",
+                },
+                "thread": Object {
+                  "properties": Object {
+                    "id": Object {
+                      "type": "long",
+                    },
+                    "name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
-              },
-              "title": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
+                "title": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "uptime": Object {
-                "type": "long",
-              },
-              "working_directory": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
+                "uptime": Object {
+                  "type": "long",
+                },
+                "working_directory": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
               },
             },
-          },
-          "pe": Object {
-            "properties": Object {
-              "architecture": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "company": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "description": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "file_version": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "imphash": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "original_file_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "product": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            "pe": Object {
+              "properties": Object {
+                "architecture": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "company": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "description": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "file_version": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "imphash": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "original_file_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "product": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
             },
-          },
-          "pgid": Object {
-            "type": "long",
-          },
-          "pid": Object {
-            "type": "long",
-          },
-          "ppid": Object {
-            "type": "long",
-          },
-          "start": Object {
-            "type": "date",
-          },
-          "thread": Object {
-            "properties": Object {
-              "id": Object {
-                "type": "long",
-              },
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            "pgid": Object {
+              "type": "long",
+            },
+            "pid": Object {
+              "type": "long",
+            },
+            "ppid": Object {
+              "type": "long",
+            },
+            "start": Object {
+              "type": "date",
+            },
+            "thread": Object {
+              "properties": Object {
+                "id": Object {
+                  "type": "long",
+                },
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
             },
-          },
-          "title": Object {
-            "fields": Object {
-              "text": Object {
-                "norms": false,
-                "type": "text",
+            "title": Object {
+              "fields": Object {
+                "text": Object {
+                  "norms": false,
+                  "type": "text",
+                },
               },
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "uptime": Object {
-            "type": "long",
-          },
-          "working_directory": Object {
-            "fields": Object {
-              "text": Object {
-                "norms": false,
-                "type": "text",
+            "uptime": Object {
+              "type": "long",
+            },
+            "working_directory": Object {
+              "fields": Object {
+                "text": Object {
+                  "norms": false,
+                  "type": "text",
+                },
               },
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-            "ignore_above": 1024,
-            "type": "keyword",
           },
         },
-      },
-      "registry": Object {
-        "properties": Object {
-          "data": Object {
-            "properties": Object {
-              "bytes": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "strings": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "type": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+        "registry": Object {
+          "properties": Object {
+            "data": Object {
+              "properties": Object {
+                "bytes": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "strings": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "type": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
             },
-          },
-          "hive": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "key": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "path": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "value": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+            "hive": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "key": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "path": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "value": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
         },
-      },
-      "related": Object {
-        "properties": Object {
-          "hash": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "hosts": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "ip": Object {
-            "type": "ip",
-          },
-          "user": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+        "related": Object {
+          "properties": Object {
+            "hash": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "hosts": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "ip": Object {
+              "type": "ip",
+            },
+            "user": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
         },
-      },
-      "rule": Object {
-        "properties": Object {
-          "author": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "category": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "description": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "license": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "reference": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "ruleset": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "uuid": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "version": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+        "rule": Object {
+          "properties": Object {
+            "author": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "category": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "description": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "license": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "reference": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "ruleset": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "uuid": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "version": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
         },
-      },
-      "server": Object {
-        "properties": Object {
-          "address": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "as": Object {
-            "properties": Object {
-              "number": Object {
-                "type": "long",
-              },
-              "organization": Object {
-                "properties": Object {
-                  "name": Object {
-                    "fields": Object {
-                      "text": Object {
-                        "norms": false,
-                        "type": "text",
+        "server": Object {
+          "properties": Object {
+            "address": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "as": Object {
+              "properties": Object {
+                "number": Object {
+                  "type": "long",
+                },
+                "organization": Object {
+                  "properties": Object {
+                    "name": Object {
+                      "fields": Object {
+                        "text": Object {
+                          "norms": false,
+                          "type": "text",
+                        },
                       },
+                      "ignore_above": 1024,
+                      "type": "keyword",
                     },
-                    "ignore_above": 1024,
-                    "type": "keyword",
                   },
                 },
               },
             },
-          },
-          "bytes": Object {
-            "type": "long",
-          },
-          "domain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "geo": Object {
-            "properties": Object {
-              "city_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "continent_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "continent_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "country_iso_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "country_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "location": Object {
-                "type": "geo_point",
-              },
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "postal_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "region_iso_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "region_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "timezone": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
+            "bytes": Object {
+              "type": "long",
             },
-          },
-          "ip": Object {
-            "type": "ip",
-          },
-          "mac": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "nat": Object {
-            "properties": Object {
-              "ip": Object {
-                "type": "ip",
-              },
-              "port": Object {
-                "type": "long",
-              },
+            "domain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-          },
-          "packets": Object {
-            "type": "long",
-          },
-          "port": Object {
-            "type": "long",
-          },
-          "registered_domain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "subdomain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "top_level_domain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "user": Object {
-            "properties": Object {
-              "domain": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "email": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            "geo": Object {
+              "properties": Object {
+                "city_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "continent_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "continent_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "country_iso_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "country_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "location": Object {
+                  "type": "geo_point",
+                },
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "postal_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "region_iso_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "region_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "timezone": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
-              "full_name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
-                  },
+            },
+            "ip": Object {
+              "type": "ip",
+            },
+            "mac": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "nat": Object {
+              "properties": Object {
+                "ip": Object {
+                  "type": "ip",
+                },
+                "port": Object {
+                  "type": "long",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
               },
-              "group": Object {
-                "properties": Object {
-                  "domain": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "id": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+            },
+            "packets": Object {
+              "type": "long",
+            },
+            "port": Object {
+              "type": "long",
+            },
+            "registered_domain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "subdomain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "top_level_domain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "user": Object {
+              "properties": Object {
+                "domain": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "email": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "full_name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
-                  "name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "group": Object {
+                  "properties": Object {
+                    "domain": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "id": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
-              },
-              "hash": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
+                "hash": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "roles": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "roles": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
               },
             },
           },
         },
-      },
-      "service": Object {
-        "properties": Object {
-          "ephemeral_id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "node": Object {
-            "properties": Object {
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+        "service": Object {
+          "properties": Object {
+            "ephemeral_id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "node": Object {
+              "properties": Object {
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
             },
-          },
-          "state": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "type": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "version": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+            "state": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "type": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "version": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
         },
-      },
-      "signal": Object {
-        "properties": Object {
-          "_meta": Object {
-            "properties": Object {
-              "version": Object {
-                "type": "long",
+        "signal": Object {
+          "properties": Object {
+            "_meta": Object {
+              "properties": Object {
+                "version": Object {
+                  "type": "long",
+                },
               },
             },
-          },
-          "ancestors": Object {
-            "properties": Object {
-              "depth": Object {
-                "type": "long",
-              },
-              "id": Object {
-                "type": "keyword",
-              },
-              "index": Object {
-                "type": "keyword",
-              },
-              "rule": Object {
-                "type": "keyword",
-              },
-              "type": Object {
-                "type": "keyword",
+            "ancestors": Object {
+              "properties": Object {
+                "depth": Object {
+                  "type": "long",
+                },
+                "id": Object {
+                  "type": "keyword",
+                },
+                "index": Object {
+                  "type": "keyword",
+                },
+                "rule": Object {
+                  "type": "keyword",
+                },
+                "type": Object {
+                  "type": "keyword",
+                },
               },
             },
-          },
-          "depth": Object {
-            "type": "integer",
-          },
-          "group": Object {
-            "properties": Object {
-              "id": Object {
-                "type": "keyword",
-              },
-              "index": Object {
-                "type": "integer",
-              },
+            "depth": Object {
+              "type": "integer",
             },
-          },
-          "original_event": Object {
-            "properties": Object {
-              "action": Object {
-                "type": "keyword",
-              },
-              "category": Object {
-                "type": "keyword",
-              },
-              "code": Object {
-                "type": "keyword",
-              },
-              "created": Object {
-                "type": "date",
-              },
-              "dataset": Object {
-                "type": "keyword",
-              },
-              "duration": Object {
-                "type": "long",
-              },
-              "end": Object {
-                "type": "date",
-              },
-              "hash": Object {
-                "type": "keyword",
-              },
-              "id": Object {
-                "type": "keyword",
-              },
-              "kind": Object {
-                "type": "keyword",
-              },
-              "module": Object {
-                "type": "keyword",
-              },
-              "original": Object {
-                "doc_values": false,
-                "index": false,
-                "type": "keyword",
-              },
-              "outcome": Object {
-                "type": "keyword",
-              },
-              "provider": Object {
-                "type": "keyword",
-              },
-              "risk_score": Object {
-                "type": "float",
-              },
-              "risk_score_norm": Object {
-                "type": "float",
-              },
-              "sequence": Object {
-                "type": "long",
-              },
-              "severity": Object {
-                "type": "long",
-              },
-              "start": Object {
-                "type": "date",
-              },
-              "timezone": Object {
-                "type": "keyword",
-              },
-              "type": Object {
-                "type": "keyword",
+            "group": Object {
+              "properties": Object {
+                "id": Object {
+                  "type": "keyword",
+                },
+                "index": Object {
+                  "type": "integer",
+                },
               },
             },
-          },
-          "original_signal": Object {
-            "dynamic": false,
-            "enabled": false,
-            "type": "object",
-          },
-          "original_time": Object {
-            "type": "date",
-          },
-          "parent": Object {
-            "properties": Object {
-              "depth": Object {
-                "type": "long",
-              },
-              "id": Object {
-                "type": "keyword",
-              },
-              "index": Object {
-                "type": "keyword",
-              },
-              "rule": Object {
-                "type": "keyword",
-              },
-              "type": Object {
-                "type": "keyword",
+            "original_event": Object {
+              "properties": Object {
+                "action": Object {
+                  "type": "keyword",
+                },
+                "category": Object {
+                  "type": "keyword",
+                },
+                "code": Object {
+                  "type": "keyword",
+                },
+                "created": Object {
+                  "type": "date",
+                },
+                "dataset": Object {
+                  "type": "keyword",
+                },
+                "duration": Object {
+                  "type": "long",
+                },
+                "end": Object {
+                  "type": "date",
+                },
+                "hash": Object {
+                  "type": "keyword",
+                },
+                "id": Object {
+                  "type": "keyword",
+                },
+                "kind": Object {
+                  "type": "keyword",
+                },
+                "module": Object {
+                  "type": "keyword",
+                },
+                "original": Object {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "keyword",
+                },
+                "outcome": Object {
+                  "type": "keyword",
+                },
+                "provider": Object {
+                  "type": "keyword",
+                },
+                "risk_score": Object {
+                  "type": "float",
+                },
+                "risk_score_norm": Object {
+                  "type": "float",
+                },
+                "sequence": Object {
+                  "type": "long",
+                },
+                "severity": Object {
+                  "type": "long",
+                },
+                "start": Object {
+                  "type": "date",
+                },
+                "timezone": Object {
+                  "type": "keyword",
+                },
+                "type": Object {
+                  "type": "keyword",
+                },
               },
             },
-          },
-          "parents": Object {
-            "properties": Object {
-              "depth": Object {
-                "type": "long",
-              },
-              "id": Object {
-                "type": "keyword",
-              },
-              "index": Object {
-                "type": "keyword",
-              },
-              "rule": Object {
-                "type": "keyword",
-              },
-              "type": Object {
-                "type": "keyword",
-              },
+            "original_signal": Object {
+              "dynamic": false,
+              "enabled": false,
+              "type": "object",
             },
-          },
-          "rule": Object {
-            "properties": Object {
-              "author": Object {
-                "type": "keyword",
-              },
-              "building_block_type": Object {
-                "type": "keyword",
-              },
-              "created_at": Object {
-                "type": "date",
-              },
-              "created_by": Object {
-                "type": "keyword",
-              },
-              "description": Object {
-                "type": "keyword",
-              },
-              "enabled": Object {
-                "type": "keyword",
-              },
-              "false_positives": Object {
-                "type": "keyword",
-              },
-              "filters": Object {
-                "type": "object",
-              },
-              "from": Object {
-                "type": "keyword",
-              },
-              "id": Object {
-                "type": "keyword",
-              },
-              "immutable": Object {
-                "type": "keyword",
-              },
-              "index": Object {
-                "type": "keyword",
-              },
-              "interval": Object {
-                "type": "keyword",
-              },
-              "language": Object {
-                "type": "keyword",
-              },
-              "license": Object {
-                "type": "keyword",
-              },
-              "max_signals": Object {
-                "type": "keyword",
-              },
-              "name": Object {
-                "type": "keyword",
-              },
-              "note": Object {
-                "type": "text",
-              },
-              "output_index": Object {
-                "type": "keyword",
-              },
-              "query": Object {
-                "type": "keyword",
-              },
-              "references": Object {
-                "type": "keyword",
-              },
-              "risk_score": Object {
-                "type": "float",
-              },
-              "risk_score_mapping": Object {
-                "properties": Object {
-                  "field": Object {
-                    "type": "keyword",
-                  },
-                  "operator": Object {
-                    "type": "keyword",
-                  },
-                  "value": Object {
-                    "type": "keyword",
-                  },
+            "original_time": Object {
+              "type": "date",
+            },
+            "parent": Object {
+              "properties": Object {
+                "depth": Object {
+                  "type": "long",
                 },
-              },
-              "rule_id": Object {
-                "type": "keyword",
-              },
-              "rule_name_override": Object {
-                "type": "keyword",
-              },
-              "saved_id": Object {
-                "type": "keyword",
-              },
-              "severity": Object {
-                "type": "keyword",
-              },
-              "severity_mapping": Object {
-                "properties": Object {
-                  "field": Object {
-                    "type": "keyword",
-                  },
-                  "operator": Object {
-                    "type": "keyword",
-                  },
-                  "severity": Object {
-                    "type": "keyword",
-                  },
-                  "value": Object {
-                    "type": "keyword",
-                  },
+                "id": Object {
+                  "type": "keyword",
+                },
+                "index": Object {
+                  "type": "keyword",
+                },
+                "rule": Object {
+                  "type": "keyword",
+                },
+                "type": Object {
+                  "type": "keyword",
                 },
               },
-              "size": Object {
-                "type": "keyword",
-              },
-              "tags": Object {
-                "type": "keyword",
+            },
+            "parents": Object {
+              "properties": Object {
+                "depth": Object {
+                  "type": "long",
+                },
+                "id": Object {
+                  "type": "keyword",
+                },
+                "index": Object {
+                  "type": "keyword",
+                },
+                "rule": Object {
+                  "type": "keyword",
+                },
+                "type": Object {
+                  "type": "keyword",
+                },
               },
-              "threat": Object {
-                "properties": Object {
-                  "framework": Object {
-                    "type": "keyword",
+            },
+            "rule": Object {
+              "properties": Object {
+                "author": Object {
+                  "type": "keyword",
+                },
+                "building_block_type": Object {
+                  "type": "keyword",
+                },
+                "created_at": Object {
+                  "type": "date",
+                },
+                "created_by": Object {
+                  "type": "keyword",
+                },
+                "description": Object {
+                  "type": "keyword",
+                },
+                "enabled": Object {
+                  "type": "keyword",
+                },
+                "false_positives": Object {
+                  "type": "keyword",
+                },
+                "filters": Object {
+                  "type": "object",
+                },
+                "from": Object {
+                  "type": "keyword",
+                },
+                "id": Object {
+                  "type": "keyword",
+                },
+                "immutable": Object {
+                  "type": "keyword",
+                },
+                "index": Object {
+                  "type": "keyword",
+                },
+                "interval": Object {
+                  "type": "keyword",
+                },
+                "language": Object {
+                  "type": "keyword",
+                },
+                "license": Object {
+                  "type": "keyword",
+                },
+                "max_signals": Object {
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "type": "keyword",
+                },
+                "note": Object {
+                  "type": "text",
+                },
+                "output_index": Object {
+                  "type": "keyword",
+                },
+                "query": Object {
+                  "type": "keyword",
+                },
+                "references": Object {
+                  "type": "keyword",
+                },
+                "risk_score": Object {
+                  "type": "float",
+                },
+                "risk_score_mapping": Object {
+                  "properties": Object {
+                    "field": Object {
+                      "type": "keyword",
+                    },
+                    "operator": Object {
+                      "type": "keyword",
+                    },
+                    "value": Object {
+                      "type": "keyword",
+                    },
                   },
-                  "tactic": Object {
-                    "properties": Object {
-                      "id": Object {
-                        "type": "keyword",
-                      },
-                      "name": Object {
-                        "type": "keyword",
-                      },
-                      "reference": Object {
-                        "type": "keyword",
-                      },
+                },
+                "rule_id": Object {
+                  "type": "keyword",
+                },
+                "rule_name_override": Object {
+                  "type": "keyword",
+                },
+                "saved_id": Object {
+                  "type": "keyword",
+                },
+                "severity": Object {
+                  "type": "keyword",
+                },
+                "severity_mapping": Object {
+                  "properties": Object {
+                    "field": Object {
+                      "type": "keyword",
+                    },
+                    "operator": Object {
+                      "type": "keyword",
+                    },
+                    "severity": Object {
+                      "type": "keyword",
+                    },
+                    "value": Object {
+                      "type": "keyword",
                     },
                   },
-                  "technique": Object {
-                    "properties": Object {
-                      "id": Object {
-                        "type": "keyword",
-                      },
-                      "name": Object {
-                        "type": "keyword",
-                      },
-                      "reference": Object {
-                        "type": "keyword",
+                },
+                "size": Object {
+                  "type": "keyword",
+                },
+                "tags": Object {
+                  "type": "keyword",
+                },
+                "threat": Object {
+                  "properties": Object {
+                    "framework": Object {
+                      "type": "keyword",
+                    },
+                    "tactic": Object {
+                      "properties": Object {
+                        "id": Object {
+                          "type": "keyword",
+                        },
+                        "name": Object {
+                          "type": "keyword",
+                        },
+                        "reference": Object {
+                          "type": "keyword",
+                        },
                       },
-                      "subtechnique": Object {
-                        "properties": Object {
-                          "id": Object {
-                            "type": "keyword",
-                          },
-                          "name": Object {
-                            "type": "keyword",
-                          },
-                          "reference": Object {
-                            "type": "keyword",
+                    },
+                    "technique": Object {
+                      "properties": Object {
+                        "id": Object {
+                          "type": "keyword",
+                        },
+                        "name": Object {
+                          "type": "keyword",
+                        },
+                        "reference": Object {
+                          "type": "keyword",
+                        },
+                        "subtechnique": Object {
+                          "properties": Object {
+                            "id": Object {
+                              "type": "keyword",
+                            },
+                            "name": Object {
+                              "type": "keyword",
+                            },
+                            "reference": Object {
+                              "type": "keyword",
+                            },
                           },
                         },
                       },
                     },
                   },
                 },
-              },
-              "threat_filters": Object {
-                "type": "object",
-              },
-              "threat_index": Object {
-                "type": "keyword",
-              },
-              "threat_indicator_path": Object {
-                "type": "keyword",
-              },
-              "threat_language": Object {
-                "type": "keyword",
-              },
-              "threat_mapping": Object {
-                "properties": Object {
-                  "entries": Object {
-                    "properties": Object {
-                      "field": Object {
-                        "type": "keyword",
-                      },
-                      "type": Object {
-                        "type": "keyword",
-                      },
-                      "value": Object {
-                        "type": "keyword",
+                "threat_filters": Object {
+                  "type": "object",
+                },
+                "threat_index": Object {
+                  "type": "keyword",
+                },
+                "threat_indicator_path": Object {
+                  "type": "keyword",
+                },
+                "threat_language": Object {
+                  "type": "keyword",
+                },
+                "threat_mapping": Object {
+                  "properties": Object {
+                    "entries": Object {
+                      "properties": Object {
+                        "field": Object {
+                          "type": "keyword",
+                        },
+                        "type": Object {
+                          "type": "keyword",
+                        },
+                        "value": Object {
+                          "type": "keyword",
+                        },
                       },
                     },
                   },
                 },
+                "threat_query": Object {
+                  "type": "keyword",
+                },
+                "threshold": Object {
+                  "properties": Object {
+                    "field": Object {
+                      "type": "keyword",
+                    },
+                    "value": Object {
+                      "type": "float",
+                    },
+                  },
+                },
+                "timeline_id": Object {
+                  "type": "keyword",
+                },
+                "timeline_title": Object {
+                  "type": "keyword",
+                },
+                "timestamp_override": Object {
+                  "type": "keyword",
+                },
+                "to": Object {
+                  "type": "keyword",
+                },
+                "type": Object {
+                  "type": "keyword",
+                },
+                "updated_at": Object {
+                  "type": "date",
+                },
+                "updated_by": Object {
+                  "type": "keyword",
+                },
+                "version": Object {
+                  "type": "keyword",
+                },
               },
-              "threat_query": Object {
-                "type": "keyword",
-              },
-              "threshold": Object {
-                "properties": Object {
-                  "field": Object {
-                    "type": "keyword",
+            },
+            "status": Object {
+              "type": "keyword",
+            },
+            "threshold_count": Object {
+              "type": "float",
+            },
+            "threshold_result": Object {
+              "properties": Object {
+                "cardinality": Object {
+                  "properties": Object {
+                    "field": Object {
+                      "type": "keyword",
+                    },
+                    "value": Object {
+                      "type": "long",
+                    },
                   },
-                  "value": Object {
-                    "type": "float",
+                },
+                "count": Object {
+                  "type": "long",
+                },
+                "from": Object {
+                  "type": "date",
+                },
+                "terms": Object {
+                  "properties": Object {
+                    "field": Object {
+                      "type": "keyword",
+                    },
+                    "value": Object {
+                      "type": "keyword",
+                    },
                   },
                 },
               },
-              "timeline_id": Object {
-                "type": "keyword",
-              },
-              "timeline_title": Object {
-                "type": "keyword",
-              },
-              "timestamp_override": Object {
-                "type": "keyword",
-              },
-              "to": Object {
-                "type": "keyword",
-              },
-              "type": Object {
-                "type": "keyword",
-              },
-              "updated_at": Object {
-                "type": "date",
-              },
-              "updated_by": Object {
-                "type": "keyword",
-              },
-              "version": Object {
-                "type": "keyword",
-              },
             },
           },
-          "status": Object {
-            "type": "keyword",
-          },
-          "threshold_count": Object {
-            "type": "float",
-          },
-          "threshold_result": Object {
-            "properties": Object {
-              "cardinality": Object {
-                "properties": Object {
-                  "field": Object {
-                    "type": "keyword",
-                  },
-                  "value": Object {
-                    "type": "long",
+        },
+        "source": Object {
+          "properties": Object {
+            "address": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "as": Object {
+              "properties": Object {
+                "number": Object {
+                  "type": "long",
+                },
+                "organization": Object {
+                  "properties": Object {
+                    "name": Object {
+                      "fields": Object {
+                        "text": Object {
+                          "norms": false,
+                          "type": "text",
+                        },
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
               },
-              "count": Object {
-                "type": "long",
-              },
-              "from": Object {
-                "type": "date",
-              },
-              "terms": Object {
-                "properties": Object {
-                  "field": Object {
-                    "type": "keyword",
-                  },
-                  "value": Object {
-                    "type": "keyword",
-                  },
+            },
+            "bytes": Object {
+              "type": "long",
+            },
+            "domain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "geo": Object {
+              "properties": Object {
+                "city_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "continent_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "continent_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "country_iso_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "country_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "location": Object {
+                  "type": "geo_point",
+                },
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "postal_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "region_iso_code": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "region_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "timezone": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
               },
             },
-          },
-        },
-      },
-      "source": Object {
-        "properties": Object {
-          "address": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "as": Object {
-            "properties": Object {
-              "number": Object {
-                "type": "long",
-              },
-              "organization": Object {
-                "properties": Object {
-                  "name": Object {
-                    "fields": Object {
-                      "text": Object {
-                        "norms": false,
-                        "type": "text",
-                      },
-                    },
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
+            "ip": Object {
+              "type": "ip",
+            },
+            "mac": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "nat": Object {
+              "properties": Object {
+                "ip": Object {
+                  "type": "ip",
+                },
+                "port": Object {
+                  "type": "long",
                 },
               },
             },
-          },
-          "bytes": Object {
-            "type": "long",
-          },
-          "domain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "geo": Object {
-            "properties": Object {
-              "city_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "continent_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "continent_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "country_iso_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "country_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "location": Object {
-                "type": "geo_point",
-              },
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "postal_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "region_iso_code": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "region_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "timezone": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
+            "packets": Object {
+              "type": "long",
             },
-          },
-          "ip": Object {
-            "type": "ip",
-          },
-          "mac": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "nat": Object {
-            "properties": Object {
-              "ip": Object {
-                "type": "ip",
-              },
-              "port": Object {
-                "type": "long",
-              },
+            "port": Object {
+              "type": "long",
             },
-          },
-          "packets": Object {
-            "type": "long",
-          },
-          "port": Object {
-            "type": "long",
-          },
-          "registered_domain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "subdomain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "top_level_domain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "user": Object {
-            "properties": Object {
-              "domain": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "email": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "full_name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
-                  },
+            "registered_domain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "subdomain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "top_level_domain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "user": Object {
+              "properties": Object {
+                "domain": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "group": Object {
-                "properties": Object {
-                  "domain": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "id": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                "email": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "full_name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
-                  "name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "group": Object {
+                  "properties": Object {
+                    "domain": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "id": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
-              },
-              "hash": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
+                "hash": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "roles": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "roles": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
               },
             },
           },
         },
-      },
-      "span": Object {
-        "properties": Object {
-          "id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+        "span": Object {
+          "properties": Object {
+            "id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
         },
-      },
-      "tags": Object {
-        "ignore_above": 1024,
-        "type": "keyword",
-      },
-      "threat": Object {
-        "properties": Object {
-          "framework": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "indicator": Object {
-            "properties": Object {
-              "as": Object {
-                "properties": Object {
-                  "number": Object {
-                    "type": "long",
-                  },
-                  "organization": Object {
-                    "properties": Object {
-                      "name": Object {
-                        "fields": Object {
-                          "text": Object {
-                            "norms": false,
-                            "type": "text",
+        "tags": Object {
+          "ignore_above": 1024,
+          "type": "keyword",
+        },
+        "threat": Object {
+          "properties": Object {
+            "framework": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "indicator": Object {
+              "properties": Object {
+                "as": Object {
+                  "properties": Object {
+                    "number": Object {
+                      "type": "long",
+                    },
+                    "organization": Object {
+                      "properties": Object {
+                        "name": Object {
+                          "fields": Object {
+                            "text": Object {
+                              "norms": false,
+                              "type": "text",
+                            },
                           },
+                          "ignore_above": 1024,
+                          "type": "keyword",
                         },
-                        "ignore_above": 1024,
-                        "type": "keyword",
                       },
                     },
                   },
                 },
-              },
-              "confidence": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "dataset": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "description": Object {
-                "type": "wildcard",
-              },
-              "domain": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "email": Object {
-                "properties": Object {
-                  "address": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
+                "confidence": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-              },
-              "event": Object {
-                "properties": Object {
-                  "action": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "category": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "code": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "created": Object {
-                    "type": "date",
-                  },
-                  "dataset": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "duration": Object {
-                    "type": "long",
-                  },
-                  "end": Object {
-                    "type": "date",
-                  },
-                  "hash": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "id": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "ingested": Object {
-                    "type": "date",
-                  },
-                  "kind": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "module": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "original": Object {
-                    "doc_values": false,
-                    "ignore_above": 1024,
-                    "index": false,
-                    "type": "keyword",
-                  },
-                  "outcome": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "provider": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "reason": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "reference": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "risk_score": Object {
-                    "type": "float",
-                  },
-                  "risk_score_norm": Object {
-                    "type": "float",
-                  },
-                  "sequence": Object {
-                    "type": "long",
-                  },
-                  "severity": Object {
-                    "type": "long",
-                  },
-                  "start": Object {
-                    "type": "date",
-                  },
-                  "timezone": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "type": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "url": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
+                "dataset": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-              },
-              "first_seen": Object {
-                "type": "date",
-              },
-              "geo": Object {
-                "properties": Object {
-                  "city_name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "continent_name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "country_iso_code": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "country_name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "location": Object {
-                    "type": "geo_point",
-                  },
-                  "name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "region_iso_code": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "region_name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                "description": Object {
+                  "type": "wildcard",
+                },
+                "domain": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "email": Object {
+                  "properties": Object {
+                    "address": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
-              },
-              "ip": Object {
-                "type": "ip",
-              },
-              "last_seen": Object {
-                "type": "date",
-              },
-              "marking": Object {
-                "properties": Object {
-                  "tlp": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                "event": Object {
+                  "properties": Object {
+                    "action": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "category": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "code": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "created": Object {
+                      "type": "date",
+                    },
+                    "dataset": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "duration": Object {
+                      "type": "long",
+                    },
+                    "end": Object {
+                      "type": "date",
+                    },
+                    "hash": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "id": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "ingested": Object {
+                      "type": "date",
+                    },
+                    "kind": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "module": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "original": Object {
+                      "doc_values": false,
+                      "ignore_above": 1024,
+                      "index": false,
+                      "type": "keyword",
+                    },
+                    "outcome": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "provider": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "reason": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "reference": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "risk_score": Object {
+                      "type": "float",
+                    },
+                    "risk_score_norm": Object {
+                      "type": "float",
+                    },
+                    "sequence": Object {
+                      "type": "long",
+                    },
+                    "severity": Object {
+                      "type": "long",
+                    },
+                    "start": Object {
+                      "type": "date",
+                    },
+                    "timezone": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "type": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "url": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
-              },
-              "matched": Object {
-                "properties": Object {
-                  "atomic": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                "first_seen": Object {
+                  "type": "date",
+                },
+                "geo": Object {
+                  "properties": Object {
+                    "city_name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "continent_name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "country_iso_code": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "country_name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "location": Object {
+                      "type": "geo_point",
+                    },
+                    "name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "region_iso_code": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "region_name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
-                  "field": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                },
+                "ip": Object {
+                  "type": "ip",
+                },
+                "last_seen": Object {
+                  "type": "date",
+                },
+                "marking": Object {
+                  "properties": Object {
+                    "tlp": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
-                  "type": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                },
+                "matched": Object {
+                  "properties": Object {
+                    "atomic": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "field": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "type": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
+                "module": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "port": Object {
+                  "type": "long",
+                },
+                "provider": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "scanner_stats": Object {
+                  "type": "long",
+                },
+                "sightings": Object {
+                  "type": "long",
+                },
+                "type": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
-              "module": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "port": Object {
-                "type": "long",
-              },
-              "provider": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "scanner_stats": Object {
-                "type": "long",
-              },
-              "sightings": Object {
-                "type": "long",
-              },
-              "type": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
+              "type": "nested",
             },
-            "type": "nested",
-          },
-          "tactic": Object {
-            "properties": Object {
-              "id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "reference": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            "tactic": Object {
+              "properties": Object {
+                "id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "reference": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
             },
-          },
-          "technique": Object {
-            "properties": Object {
-              "id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
-                  },
+            "technique": Object {
+              "properties": Object {
+                "id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "reference": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "subtechnique": Object {
-                "properties": Object {
-                  "id": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                "name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
-                  "name": Object {
-                    "fields": Object {
-                      "text": Object {
-                        "norms": false,
-                        "type": "text",
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "reference": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "subtechnique": Object {
+                  "properties": Object {
+                    "id": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "name": Object {
+                      "fields": Object {
+                        "text": Object {
+                          "norms": false,
+                          "type": "text",
+                        },
                       },
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "reference": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
                     },
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "reference": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
                   },
                 },
               },
             },
           },
         },
-      },
-      "tls": Object {
-        "properties": Object {
-          "cipher": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "client": Object {
-            "properties": Object {
-              "certificate": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "certificate_chain": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "hash": Object {
-                "properties": Object {
-                  "md5": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "sha1": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "sha256": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
+        "tls": Object {
+          "properties": Object {
+            "cipher": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "client": Object {
+              "properties": Object {
+                "certificate": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-              },
-              "issuer": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "ja3": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "not_after": Object {
-                "type": "date",
-              },
-              "not_before": Object {
-                "type": "date",
-              },
-              "server_name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "subject": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "supported_ciphers": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "x509": Object {
-                "properties": Object {
-                  "alternative_names": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "issuer": Object {
-                    "properties": Object {
-                      "common_name": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "country": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "distinguished_name": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "locality": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "organization": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "organizational_unit": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "state_or_province": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
+                "certificate_chain": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "hash": Object {
+                  "properties": Object {
+                    "md5": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "sha1": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "sha256": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
                     },
                   },
-                  "not_after": Object {
-                    "type": "date",
-                  },
-                  "not_before": Object {
-                    "type": "date",
-                  },
-                  "public_key_algorithm": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "public_key_curve": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "public_key_exponent": Object {
-                    "doc_values": false,
-                    "index": false,
-                    "type": "long",
-                  },
-                  "public_key_size": Object {
-                    "type": "long",
-                  },
-                  "serial_number": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "signature_algorithm": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "subject": Object {
-                    "properties": Object {
-                      "common_name": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "country": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "distinguished_name": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "locality": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "organization": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "organizational_unit": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
+                },
+                "issuer": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "ja3": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "not_after": Object {
+                  "type": "date",
+                },
+                "not_before": Object {
+                  "type": "date",
+                },
+                "server_name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "subject": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "supported_ciphers": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "x509": Object {
+                  "properties": Object {
+                    "alternative_names": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "issuer": Object {
+                      "properties": Object {
+                        "common_name": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "country": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "distinguished_name": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "locality": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "organization": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "organizational_unit": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "state_or_province": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
                       },
-                      "state_or_province": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
+                    },
+                    "not_after": Object {
+                      "type": "date",
+                    },
+                    "not_before": Object {
+                      "type": "date",
+                    },
+                    "public_key_algorithm": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "public_key_curve": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "public_key_exponent": Object {
+                      "doc_values": false,
+                      "index": false,
+                      "type": "long",
+                    },
+                    "public_key_size": Object {
+                      "type": "long",
+                    },
+                    "serial_number": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "signature_algorithm": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "subject": Object {
+                      "properties": Object {
+                        "common_name": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "country": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "distinguished_name": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "locality": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "organization": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "organizational_unit": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "state_or_province": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
                       },
                     },
-                  },
-                  "version_number": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                    "version_number": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
               },
             },
-          },
-          "curve": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "established": Object {
-            "type": "boolean",
-          },
-          "next_protocol": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "resumed": Object {
-            "type": "boolean",
-          },
-          "server": Object {
-            "properties": Object {
-              "certificate": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "certificate_chain": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "hash": Object {
-                "properties": Object {
-                  "md5": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "sha1": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "sha256": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
+            "curve": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "established": Object {
+              "type": "boolean",
+            },
+            "next_protocol": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "resumed": Object {
+              "type": "boolean",
+            },
+            "server": Object {
+              "properties": Object {
+                "certificate": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-              },
-              "issuer": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "ja3s": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "not_after": Object {
-                "type": "date",
-              },
-              "not_before": Object {
-                "type": "date",
-              },
-              "subject": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "x509": Object {
-                "properties": Object {
-                  "alternative_names": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "issuer": Object {
-                    "properties": Object {
-                      "common_name": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "country": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "distinguished_name": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "locality": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "organization": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "organizational_unit": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "state_or_province": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
+                "certificate_chain": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "hash": Object {
+                  "properties": Object {
+                    "md5": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "sha1": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "sha256": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
                     },
                   },
-                  "not_after": Object {
-                    "type": "date",
-                  },
-                  "not_before": Object {
-                    "type": "date",
-                  },
-                  "public_key_algorithm": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "public_key_curve": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "public_key_exponent": Object {
-                    "doc_values": false,
-                    "index": false,
-                    "type": "long",
-                  },
-                  "public_key_size": Object {
-                    "type": "long",
-                  },
-                  "serial_number": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "signature_algorithm": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "subject": Object {
-                    "properties": Object {
-                      "common_name": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "country": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "distinguished_name": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "locality": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "organization": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
-                      },
-                      "organizational_unit": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
+                },
+                "issuer": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "ja3s": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "not_after": Object {
+                  "type": "date",
+                },
+                "not_before": Object {
+                  "type": "date",
+                },
+                "subject": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "x509": Object {
+                  "properties": Object {
+                    "alternative_names": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "issuer": Object {
+                      "properties": Object {
+                        "common_name": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "country": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "distinguished_name": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "locality": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "organization": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "organizational_unit": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "state_or_province": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
                       },
-                      "state_or_province": Object {
-                        "ignore_above": 1024,
-                        "type": "keyword",
+                    },
+                    "not_after": Object {
+                      "type": "date",
+                    },
+                    "not_before": Object {
+                      "type": "date",
+                    },
+                    "public_key_algorithm": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "public_key_curve": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "public_key_exponent": Object {
+                      "doc_values": false,
+                      "index": false,
+                      "type": "long",
+                    },
+                    "public_key_size": Object {
+                      "type": "long",
+                    },
+                    "serial_number": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "signature_algorithm": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "subject": Object {
+                      "properties": Object {
+                        "common_name": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "country": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "distinguished_name": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "locality": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "organization": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "organizational_unit": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
+                        "state_or_province": Object {
+                          "ignore_above": 1024,
+                          "type": "keyword",
+                        },
                       },
                     },
-                  },
-                  "version_number": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                    "version_number": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
               },
             },
-          },
-          "version": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "version_protocol": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+            "version": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "version_protocol": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
         },
-      },
-      "trace": Object {
-        "properties": Object {
-          "id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+        "trace": Object {
+          "properties": Object {
+            "id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
         },
-      },
-      "transaction": Object {
-        "properties": Object {
-          "id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+        "transaction": Object {
+          "properties": Object {
+            "id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
         },
-      },
-      "url": Object {
-        "properties": Object {
-          "domain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "extension": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "fragment": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "full": Object {
-            "fields": Object {
-              "text": Object {
-                "norms": false,
-                "type": "text",
+        "url": Object {
+          "properties": Object {
+            "domain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "extension": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "fragment": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "full": Object {
+              "fields": Object {
+                "text": Object {
+                  "norms": false,
+                  "type": "text",
+                },
               },
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "original": Object {
-            "fields": Object {
-              "text": Object {
-                "norms": false,
-                "type": "text",
+            "original": Object {
+              "fields": Object {
+                "text": Object {
+                  "norms": false,
+                  "type": "text",
+                },
               },
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "password": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "path": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "port": Object {
+              "type": "long",
+            },
+            "query": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "registered_domain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "scheme": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "subdomain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "top_level_domain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "username": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "password": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "path": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "port": Object {
-            "type": "long",
-          },
-          "query": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "registered_domain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "scheme": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "subdomain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "top_level_domain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "username": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
           },
         },
-      },
-      "user": Object {
-        "properties": Object {
-          "changes": Object {
-            "properties": Object {
-              "domain": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "email": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "full_name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
-                  },
+        "user": Object {
+          "properties": Object {
+            "changes": Object {
+              "properties": Object {
+                "domain": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "group": Object {
-                "properties": Object {
-                  "domain": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "id": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                "email": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "full_name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
-                  "name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "group": Object {
+                  "properties": Object {
+                    "domain": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "id": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
-              },
-              "hash": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
+                "hash": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "roles": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "roles": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
               },
             },
-          },
-          "domain": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "effective": Object {
-            "properties": Object {
-              "domain": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "email": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "full_name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
-                  },
+            "domain": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "effective": Object {
+              "properties": Object {
+                "domain": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "group": Object {
-                "properties": Object {
-                  "domain": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "id": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                "email": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "full_name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
-                  "name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "group": Object {
+                  "properties": Object {
+                    "domain": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "id": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
-              },
-              "hash": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
+                "hash": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "roles": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "roles": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
               },
             },
-          },
-          "email": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "full_name": Object {
-            "fields": Object {
-              "text": Object {
-                "norms": false,
-                "type": "text",
-              },
+            "email": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "group": Object {
-            "properties": Object {
-              "domain": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            "full_name": Object {
+              "fields": Object {
+                "text": Object {
+                  "norms": false,
+                  "type": "text",
+                },
               },
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-          },
-          "hash": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "name": Object {
-            "fields": Object {
-              "text": Object {
-                "norms": false,
-                "type": "text",
+            "group": Object {
+              "properties": Object {
+                "domain": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
             },
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "roles": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "target": Object {
-            "properties": Object {
-              "domain": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "email": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "full_name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
-                  },
+            "hash": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "name": Object {
+              "fields": Object {
+                "text": Object {
+                  "norms": false,
+                  "type": "text",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
               },
-              "group": Object {
-                "properties": Object {
-                  "domain": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
-                  },
-                  "id": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "roles": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "target": Object {
+              "properties": Object {
+                "domain": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "email": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "full_name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
-                  "name": Object {
-                    "ignore_above": 1024,
-                    "type": "keyword",
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "group": Object {
+                  "properties": Object {
+                    "domain": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "id": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
+                    "name": Object {
+                      "ignore_above": 1024,
+                      "type": "keyword",
+                    },
                   },
                 },
-              },
-              "hash": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "id": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
+                "hash": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "id": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "roles": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "roles": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
               },
             },
           },
         },
-      },
-      "user_agent": Object {
-        "properties": Object {
-          "device": Object {
-            "properties": Object {
-              "name": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+        "user_agent": Object {
+          "properties": Object {
+            "device": Object {
+              "properties": Object {
+                "name": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
             },
-          },
-          "name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "original": Object {
-            "fields": Object {
-              "text": Object {
-                "norms": false,
-                "type": "text",
-              },
+            "name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "os": Object {
-            "properties": Object {
-              "family": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            "original": Object {
+              "fields": Object {
+                "text": Object {
+                  "norms": false,
+                  "type": "text",
+                },
               },
-              "full": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "os": Object {
+              "properties": Object {
+                "family": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "full": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "kernel": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "name": Object {
-                "fields": Object {
-                  "text": Object {
-                    "norms": false,
-                    "type": "text",
+                "kernel": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "name": Object {
+                  "fields": Object {
+                    "text": Object {
+                      "norms": false,
+                      "type": "text",
+                    },
                   },
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "platform": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "type": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
+                "version": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
                 },
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "platform": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "type": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
-              "version": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
               },
             },
-          },
-          "version": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+            "version": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
         },
-      },
-      "vlan": Object {
-        "properties": Object {
-          "id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "name": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+        "vlan": Object {
+          "properties": Object {
+            "id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "name": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
         },
-      },
-      "vulnerability": Object {
-        "properties": Object {
-          "category": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "classification": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "description": Object {
-            "fields": Object {
-              "text": Object {
-                "norms": false,
-                "type": "text",
-              },
+        "vulnerability": Object {
+          "properties": Object {
+            "category": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "enumeration": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "reference": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "report_id": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
-          },
-          "scanner": Object {
-            "properties": Object {
-              "vendor": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
-              },
+            "classification": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
             },
-          },
-          "score": Object {
-            "properties": Object {
-              "base": Object {
-                "type": "float",
-              },
-              "environmental": Object {
-                "type": "float",
+            "description": Object {
+              "fields": Object {
+                "text": Object {
+                  "norms": false,
+                  "type": "text",
+                },
               },
-              "temporal": Object {
-                "type": "float",
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "enumeration": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "reference": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "report_id": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
+            "scanner": Object {
+              "properties": Object {
+                "vendor": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
-              "version": Object {
-                "ignore_above": 1024,
-                "type": "keyword",
+            },
+            "score": Object {
+              "properties": Object {
+                "base": Object {
+                  "type": "float",
+                },
+                "environmental": Object {
+                  "type": "float",
+                },
+                "temporal": Object {
+                  "type": "float",
+                },
+                "version": Object {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                },
               },
             },
-          },
-          "severity": Object {
-            "ignore_above": 1024,
-            "type": "keyword",
+            "severity": Object {
+              "ignore_above": 1024,
+              "type": "keyword",
+            },
           },
         },
       },
     },
-  },
-  "settings": Object {
-    "index": Object {
-      "lifecycle": Object {
-        "name": "test-index",
-        "rollover_alias": "test-index",
+    "settings": Object {
+      "index": Object {
+        "lifecycle": Object {
+          "name": "test-index",
+          "rollover_alias": "test-index",
+        },
       },
-    },
-    "mapping": Object {
-      "total_fields": Object {
-        "limit": 10000,
+      "mapping": Object {
+        "total_fields": Object {
+          "limit": 10000,
+        },
       },
     },
   },
-  "version": 45,
+  "version": 55,
 }
 `;
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/check_template_version.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/check_template_version.ts
index 164c8644acaa9d..974d18292a078c 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/check_template_version.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/check_template_version.ts
@@ -5,9 +5,14 @@
  * 2.0.
  */
 
+import { get } from 'lodash';
 import { ElasticsearchClient } from 'src/core/server';
 import { isOutdated } from '../../migrations/helpers';
-import { SIGNALS_TEMPLATE_VERSION } from './get_signals_template';
+import {
+  ALIAS_VERSION_FIELD,
+  SIGNALS_FIELD_ALIASES_VERSION,
+  SIGNALS_TEMPLATE_VERSION,
+} from './get_signals_template';
 
 export const getTemplateVersion = async ({
   alias,
@@ -17,10 +22,8 @@ export const getTemplateVersion = async ({
   alias: string;
 }): Promise<number> => {
   try {
-    const response = await esClient.indices.getTemplate<{
-      [templateName: string]: { version: number };
-    }>({ name: alias });
-    return response.body[alias].version ?? 0;
+    const response = await esClient.indices.getIndexTemplate({ name: alias });
+    return response.body.index_templates[0].index_template.version ?? 0;
   } catch (e) {
     return 0;
   }
@@ -37,3 +40,14 @@ export const templateNeedsUpdate = async ({
 
   return isOutdated({ current: templateVersion, target: SIGNALS_TEMPLATE_VERSION });
 };
+
+export const fieldAliasesOutdated = async (esClient: ElasticsearchClient, index: string) => {
+  const { body: indexMappings } = await esClient.indices.get({ index });
+  for (const [_, mapping] of Object.entries(indexMappings)) {
+    const aliasesVersion = get(mapping.mappings?._meta, ALIAS_VERSION_FIELD) ?? 0;
+    if (aliasesVersion < SIGNALS_FIELD_ALIASES_VERSION) {
+      return true;
+    }
+  }
+  return false;
+};
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/create_index_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/create_index_route.ts
index d98cd7cea0f2b7..c6635eec520b22 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/create_index_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/create_index_route.ts
@@ -5,12 +5,14 @@
  * 2.0.
  */
 
+import { get } from 'lodash';
+import { estypes } from '@elastic/elasticsearch';
+import { ElasticsearchClient } from 'src/core/server';
 import {
   transformError,
   getIndexExists,
   getPolicyExists,
   setPolicy,
-  setTemplate,
   createBootstrapIndex,
 } from '@kbn/securitysolution-es-utils';
 import type {
@@ -20,14 +22,29 @@ import type {
 } from '../../../../types';
 import { DETECTION_ENGINE_INDEX_URL } from '../../../../../common/constants';
 import { buildSiemResponse } from '../utils';
-import { getSignalsTemplate, SIGNALS_TEMPLATE_VERSION } from './get_signals_template';
+import {
+  createSignalsFieldAliases,
+  getSignalsTemplate,
+  getRbacRequiredFields,
+  SIGNALS_TEMPLATE_VERSION,
+  SIGNALS_FIELD_ALIASES_VERSION,
+  ALIAS_VERSION_FIELD,
+} from './get_signals_template';
 import { ensureMigrationCleanupPolicy } from '../../migrations/migration_cleanup';
 import signalsPolicy from './signals_policy.json';
 import { templateNeedsUpdate } from './check_template_version';
 import { getIndexVersion } from './get_index_version';
 import { isOutdated } from '../../migrations/helpers';
+import { RuleDataPluginService } from '../../../../../../rule_registry/server';
+import signalExtraFields from './signal_extra_fields.json';
+import { ConfigType } from '../../../../config';
+import { parseExperimentalConfigValue } from '../../../../../common/experimental_features';
 
-export const createIndexRoute = (router: SecuritySolutionPluginRouter) => {
+export const createIndexRoute = (
+  router: SecuritySolutionPluginRouter,
+  ruleDataService: RuleDataPluginService,
+  config: ConfigType
+) => {
   router.post(
     {
       path: DETECTION_ENGINE_INDEX_URL,
@@ -38,13 +55,14 @@ export const createIndexRoute = (router: SecuritySolutionPluginRouter) => {
     },
     async (context, request, response) => {
       const siemResponse = buildSiemResponse(response);
+      const { ruleRegistryEnabled } = parseExperimentalConfigValue(config.enableExperimental);
 
       try {
         const siemClient = context.securitySolution?.getAppClient();
         if (!siemClient) {
           return siemResponse.error({ statusCode: 404 });
         }
-        await createDetectionIndex(context, siemClient!);
+        await createDetectionIndex(context, siemClient!, ruleDataService, ruleRegistryEnabled);
         return response.ok({ body: { acknowledged: true } });
       } catch (err) {
         const error = transformError(err);
@@ -67,25 +85,58 @@ class CreateIndexError extends Error {
 
 export const createDetectionIndex = async (
   context: SecuritySolutionRequestHandlerContext,
-  siemClient: AppClient
+  siemClient: AppClient,
+  ruleDataService: RuleDataPluginService,
+  ruleRegistryEnabled: boolean
 ): Promise<void> => {
   const esClient = context.core.elasticsearch.client.asCurrentUser;
+  const spaceId = siemClient.getSpaceId();
 
   if (!siemClient) {
     throw new CreateIndexError('', 404);
   }
 
   const index = siemClient.getSignalsIndex();
+
+  const indexExists = await getIndexExists(esClient, index);
+  // If using the rule registry implementation, we don't want to create new .siem-signals indices -
+  // only create/update resources if there are existing indices
+  if (ruleRegistryEnabled && !indexExists) {
+    return;
+  }
+
   await ensureMigrationCleanupPolicy({ alias: index, esClient });
   const policyExists = await getPolicyExists(esClient, index);
   if (!policyExists) {
     await setPolicy(esClient, index, signalsPolicy);
   }
+  const aadIndexAliasName = `${ruleDataService.getFullAssetName('security.alerts')}-${spaceId}`;
   if (await templateNeedsUpdate({ alias: index, esClient })) {
-    await setTemplate(esClient, index, getSignalsTemplate(index));
+    await esClient.indices.putIndexTemplate({
+      name: index,
+      body: getSignalsTemplate(index, spaceId, aadIndexAliasName) as Record<string, unknown>,
+    });
   }
-  const indexExists = await getIndexExists(esClient, index);
+  // Check if the old legacy siem signals template exists and remove it
+  try {
+    await esClient.indices.deleteTemplate({ name: index });
+  } catch (err) {
+    if (err.statusCode !== 404) {
+      throw err;
+    }
+  }
+
   if (indexExists) {
+    await addFieldAliasesToIndices({ esClient, index, spaceId });
+    // The internal user is used here because Elasticsearch requires the PUT alias requestor to have 'manage' permissions
+    // for BOTH the index AND alias name. However, through 7.14 admins only needed permissions for .siem-signals (the index)
+    // and not .alerts-security.alerts (the alias). From the security solution perspective, all .siem-signals-<space id>-*
+    // indices should have an alias to .alerts-security.alerts-<space id> so it's safe to add those aliases as the internal user.
+    await addIndexAliases({
+      esClient: context.core.elasticsearch.client.asInternalUser,
+      index,
+      aadIndexAliasName,
+    });
     const indexVersion = await getIndexVersion(esClient, index);
     if (isOutdated({ current: indexVersion, target: SIGNALS_TEMPLATE_VERSION })) {
       await esClient.indices.rollover({ alias: index });
@@ -94,3 +145,62 @@ export const createDetectionIndex = async (
     await createBootstrapIndex(esClient, index);
   }
 };
+
+const addFieldAliasesToIndices = async ({
+  esClient,
+  index,
+  spaceId,
+}: {
+  esClient: ElasticsearchClient;
+  index: string;
+  spaceId: string;
+}) => {
+  const { body: indexMappings } = await esClient.indices.get({ index });
+  // Make sure that all signal fields we add aliases for are guaranteed to exist in the mapping for ALL historical
+  // signals indices (either by adding them to signalExtraFields or ensuring they exist in the original signals
+  // mapping) or else this call will fail and not update ANY signals indices
+  const fieldAliases = createSignalsFieldAliases();
+  for (const [indexName, mapping] of Object.entries(indexMappings)) {
+    const currentVersion: number | undefined = get(mapping.mappings?._meta, 'version');
+    const newMapping = {
+      properties: {
+        ...signalExtraFields,
+        ...fieldAliases,
+        ...getRbacRequiredFields(spaceId),
+      },
+      _meta: {
+        version: currentVersion,
+        [ALIAS_VERSION_FIELD]: SIGNALS_FIELD_ALIASES_VERSION,
+      },
+    };
+    await esClient.indices.putMapping({
+      index: indexName,
+      body: newMapping,
+      allow_no_indices: true,
+    } as estypes.IndicesPutMappingRequest);
+  }
+};
+
+const addIndexAliases = async ({
+  esClient,
+  index,
+  aadIndexAliasName,
+}: {
+  esClient: ElasticsearchClient;
+  index: string;
+  aadIndexAliasName: string;
+}) => {
+  const { body: indices } = await esClient.indices.getAlias({ name: index });
+  const aliasActions = {
+    actions: Object.keys(indices).map((concreteIndexName) => {
+      return {
+        add: {
+          index: concreteIndexName,
+          alias: aadIndexAliasName,
+          is_write_index: false,
+        },
+      };
+    }),
+  };
+  await esClient.indices.updateAliases({ body: aliasActions });
+};
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/delete_index_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/delete_index_route.ts
index 5260c9487de8a5..6d1422a660abca 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/delete_index_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/delete_index_route.ts
@@ -10,9 +10,7 @@ import {
   getIndexExists,
   getPolicyExists,
   deletePolicy,
-  getTemplateExists,
   deleteAllIndex,
-  deleteTemplate,
 } from '@kbn/securitysolution-es-utils';
 import type { SecuritySolutionPluginRouter } from '../../../../types';
 import { DETECTION_ENGINE_INDEX_URL } from '../../../../../common/constants';
@@ -22,6 +20,7 @@ import { buildSiemResponse } from '../utils';
  * Deletes all of the indexes, template, ilm policies, and aliases. You can check
  * this by looking at each of these settings from ES after a deletion:
  * GET /_template/.siem-signals-default
+ * GET /_index_template/.siem-signals-default
  * GET /.siem-signals-default-000001/
  * GET /_ilm/policy/.signals-default
  * GET /_alias/.siem-signals-default
@@ -63,9 +62,13 @@ export const deleteIndexRoute = (router: SecuritySolutionPluginRouter) => {
           if (policyExists) {
             await deletePolicy(esClient, index);
           }
-          const templateExists = await getTemplateExists(esClient, index);
+          const templateExists = await esClient.indices.existsIndexTemplate({ name: index });
           if (templateExists) {
-            await deleteTemplate(esClient, index);
+            await esClient.indices.deleteIndexTemplate({ name: index });
+          }
+          const legacyTemplateExists = await esClient.indices.existsTemplate({ name: index });
+          if (legacyTemplateExists) {
+            await esClient.indices.deleteTemplate({ name: index });
           }
           return response.ok({ body: { acknowledged: true } });
         }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/get_signals_template.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/get_signals_template.test.ts
index 4691db1b19595e..88c549cec55797 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/get_signals_template.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/get_signals_template.test.ts
@@ -9,8 +9,12 @@ import { getSignalsTemplate } from './get_signals_template';
 
 describe('get_signals_template', () => {
   test('it should set the lifecycle "name" and "rollover_alias" to be the name of the index passed in', () => {
-    const template = getSignalsTemplate('test-index');
-    expect(template.settings).toEqual({
+    const template = getSignalsTemplate(
+      'test-index',
+      'space-id',
+      '.alerts-security.alerts-space-id'
+    );
+    expect(template.template.settings).toEqual({
       index: {
         lifecycle: {
           name: 'test-index',
@@ -24,23 +28,39 @@ describe('get_signals_template', () => {
   });
 
   test('it should set have the index patterns with an ending glob in it', () => {
-    const template = getSignalsTemplate('test-index');
+    const template = getSignalsTemplate(
+      'test-index',
+      'space-id',
+      '.alerts-security.alerts-space-id'
+    );
     expect(template.index_patterns).toEqual(['test-index-*']);
   });
 
   test('it should have a mappings section which is an object type', () => {
-    const template = getSignalsTemplate('test-index');
-    expect(typeof template.mappings).toEqual('object');
+    const template = getSignalsTemplate(
+      'test-index',
+      'space-id',
+      '.alerts-security.alerts-space-id'
+    );
+    expect(typeof template.template.mappings).toEqual('object');
   });
 
   test('it should have a signals section which is an object type', () => {
-    const template = getSignalsTemplate('test-index');
-    expect(typeof template.mappings.properties.signal).toEqual('object');
+    const template = getSignalsTemplate(
+      'test-index',
+      'space-id',
+      '.alerts-security.alerts-space-id'
+    );
+    expect(typeof template.template.mappings.properties.signal).toEqual('object');
   });
 
   test('it should have a "total_fields" section that is at least 10k in size', () => {
-    const template = getSignalsTemplate('test-index');
-    expect(template.settings.mapping.total_fields.limit).toBeGreaterThanOrEqual(10000);
+    const template = getSignalsTemplate(
+      'test-index',
+      'space-id',
+      '.alerts-security.alerts-space-id'
+    );
+    expect(template.template.settings.mapping.total_fields.limit).toBeGreaterThanOrEqual(10000);
   });
 
   // If you see this test fail, you should track down any and all "constant_keyword" in your ecs_mapping.json and replace
@@ -62,7 +82,11 @@ describe('get_signals_template', () => {
   // Instead you have to use "keyword". This test was first introduced when ECS 1.10 came out and data_stream.* values which had
   // "constant_keyword" fields and we needed to change those to be "keyword" instead.
   test('it should NOT have any "constant_keyword" and instead those should be replaced with regular "keyword" in the mapping', () => {
-    const template = getSignalsTemplate('test-index');
+    const template = getSignalsTemplate(
+      'test-index',
+      'space-id',
+      '.alerts-security.alerts-space-id'
+    );
 
     // Small recursive function to find any values of "constant_keyword" and mark which fields it was found on and then error on those fields
     // The matchers from jest such as jest.toMatchObject do not support recursion, so I have to write it here:
@@ -83,11 +107,20 @@ describe('get_signals_template', () => {
         }
       }, []);
     const constantKeywordsFound = recursiveConstantKeywordFound('', template);
-    expect(constantKeywordsFound).toEqual([]);
+    expect(constantKeywordsFound).toEqual([
+      'template.mappings.properties.kibana.space_ids',
+      'template.mappings.properties.kibana.alert.consumers',
+      'template.mappings.properties.kibana.alert.producer',
+      'template.mappings.properties.kibana.alert.rule.rule_type_id',
+    ]);
   });
 
   test('it should match snapshot', () => {
-    const template = getSignalsTemplate('test-index');
+    const template = getSignalsTemplate(
+      'test-index',
+      'space-id',
+      '.alerts-security.alerts-space-id'
+    );
     expect(template).toMatchSnapshot();
   });
 });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/get_signals_template.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/get_signals_template.ts
index 53035ebf28cd78..bc41441e1a1179 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/get_signals_template.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/get_signals_template.ts
@@ -5,9 +5,16 @@
  * 2.0.
  */
 
+import {
+  SPACE_IDS,
+  ALERT_CONSUMERS,
+  ALERT_PRODUCER,
+  ALERT_RULE_TYPE_ID,
+} from '@kbn/rule-data-utils';
 import signalsMapping from './signals_mapping.json';
 import ecsMapping from './ecs_mapping.json';
 import otherMapping from './other_mappings.json';
+import aadFieldConversion from './signal_aad_mapping.json';
 
 /**
   @constant
@@ -22,50 +29,107 @@ import otherMapping from './other_mappings.json';
   incremented by 10 in order to add "room" for the aforementioned patch
   release
 */
-export const SIGNALS_TEMPLATE_VERSION = 45;
+export const SIGNALS_TEMPLATE_VERSION = 55;
+/**
+  @constant
+  @type {number}
+  @description This value represents the version of the field aliases that map the new field names
+  used for alerts-as-data to the old signal.* field names. If any .siem-signals-<space id> indices
+  have an aliases_version less than this value, the detections UI will call create_index_route and
+  and go through the index update process. Increment this number if making changes to the field
+  aliases we use to make signals forwards-compatible.
+*/
+export const SIGNALS_FIELD_ALIASES_VERSION = 1;
 export const MIN_EQL_RULE_INDEX_VERSION = 2;
+export const ALIAS_VERSION_FIELD = 'aliases_version';
 
-export const getSignalsTemplate = (index: string) => {
+export const getSignalsTemplate = (index: string, spaceId: string, aadIndexAliasName: string) => {
+  const fieldAliases = createSignalsFieldAliases();
   const template = {
-    settings: {
-      index: {
-        lifecycle: {
-          name: index,
-          rollover_alias: index,
+    index_patterns: [`${index}-*`],
+    template: {
+      aliases: {
+        [aadIndexAliasName]: {
+          is_write_index: false,
         },
       },
-      mapping: {
-        total_fields: {
-          limit: 10000,
+      settings: {
+        index: {
+          lifecycle: {
+            name: index,
+            rollover_alias: index,
+          },
+        },
+        mapping: {
+          total_fields: {
+            limit: 10000,
+          },
         },
       },
-    },
-    index_patterns: [`${index}-*`],
-    mappings: {
-      dynamic: false,
-      properties: {
-        ...ecsMapping.mappings.properties,
-        ...otherMapping.mappings.properties,
-        signal: signalsMapping.mappings.properties.signal,
-        threat: {
-          ...ecsMapping.mappings.properties.threat,
-          properties: {
-            ...ecsMapping.mappings.properties.threat.properties,
-            indicator: {
-              ...otherMapping.mappings.properties.threat.properties.indicator,
-              properties: {
-                ...otherMapping.mappings.properties.threat.properties.indicator.properties,
-                event: ecsMapping.mappings.properties.event,
+      mappings: {
+        dynamic: false,
+        properties: {
+          ...ecsMapping.mappings.properties,
+          ...otherMapping.mappings.properties,
+          ...fieldAliases,
+          ...getRbacRequiredFields(spaceId),
+          signal: signalsMapping.mappings.properties.signal,
+          threat: {
+            ...ecsMapping.mappings.properties.threat,
+            properties: {
+              ...ecsMapping.mappings.properties.threat.properties,
+              indicator: {
+                ...otherMapping.mappings.properties.threat.properties.indicator,
+                properties: {
+                  ...otherMapping.mappings.properties.threat.properties.indicator.properties,
+                  event: ecsMapping.mappings.properties.event,
+                },
               },
             },
           },
         },
-      },
-      _meta: {
-        version: SIGNALS_TEMPLATE_VERSION,
+        _meta: {
+          version: SIGNALS_TEMPLATE_VERSION,
+          [ALIAS_VERSION_FIELD]: SIGNALS_FIELD_ALIASES_VERSION,
+        },
       },
     },
     version: SIGNALS_TEMPLATE_VERSION,
   };
   return template;
 };
+
+export const createSignalsFieldAliases = () => {
+  const fieldAliases: Record<string, unknown> = {};
+  Object.entries(aadFieldConversion).forEach(([key, value]) => {
+    fieldAliases[value] = {
+      type: 'alias',
+      path: key,
+    };
+  });
+  return fieldAliases;
+};
+
+export const getRbacRequiredFields = (spaceId: string) => {
+  return {
+    [SPACE_IDS]: {
+      type: 'constant_keyword',
+      value: spaceId,
+    },
+    [ALERT_CONSUMERS]: {
+      type: 'constant_keyword',
+      value: 'siem',
+    },
+    [ALERT_PRODUCER]: {
+      type: 'constant_keyword',
+      value: 'siem',
+    },
+    // TODO: discuss naming of this field and what the value will be for legacy signals.
+    // Can we leave it as 'siem.signals' or do we need a runtime field that will map signal.rule.type
+    // to the new ruleTypeId?
+    [ALERT_RULE_TYPE_ID]: {
+      type: 'constant_keyword',
+      value: 'siem.signals',
+    },
+  };
+};
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/read_index_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/read_index_route.ts
index 3527e43c03d52b..4cfedd5dcaa011 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/read_index_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/read_index_route.ts
@@ -15,6 +15,7 @@ import { buildSiemResponse } from '../utils';
 import { SIGNALS_TEMPLATE_VERSION } from './get_signals_template';
 import { getIndexVersion } from './get_index_version';
 import { isOutdated } from '../../migrations/helpers';
+import { fieldAliasesOutdated } from './check_template_version';
 
 export const readIndexRoute = (router: SecuritySolutionPluginRouter, config: ConfigType) => {
   router.get(
@@ -38,23 +39,20 @@ export const readIndexRoute = (router: SecuritySolutionPluginRouter, config: Con
 
         // TODO: Once we are past experimental phase this code should be removed
         const { ruleRegistryEnabled } = parseExperimentalConfigValue(config.enableExperimental);
-        if (ruleRegistryEnabled) {
-          return response.ok({
-            body: { name: DEFAULT_ALERTS_INDEX, index_mapping_outdated: false },
-          });
-        }
 
         const index = siemClient.getSignalsIndex();
-        const indexExists = ruleRegistryEnabled ? true : await getIndexExists(esClient, index);
+        const indexExists = await getIndexExists(esClient, index);
 
         if (indexExists) {
           let mappingOutdated: boolean | null = null;
+          let aliasesOutdated: boolean | null = null;
           try {
             const indexVersion = await getIndexVersion(esClient, index);
             mappingOutdated = isOutdated({
               current: indexVersion,
               target: SIGNALS_TEMPLATE_VERSION,
             });
+            aliasesOutdated = await fieldAliasesOutdated(esClient, index);
           } catch (err) {
             const error = transformError(err);
             // Some users may not have the view_index_metadata permission necessary to check the index mapping version
@@ -66,12 +64,26 @@ export const readIndexRoute = (router: SecuritySolutionPluginRouter, config: Con
               });
             }
           }
-          return response.ok({ body: { name: index, index_mapping_outdated: mappingOutdated } });
-        } else {
-          return siemResponse.error({
-            statusCode: 404,
-            body: 'index for this space does not exist',
+          return response.ok({
+            body: {
+              name: ruleRegistryEnabled ? DEFAULT_ALERTS_INDEX : index,
+              index_mapping_outdated: mappingOutdated || aliasesOutdated,
+            },
           });
+        } else {
+          if (ruleRegistryEnabled) {
+            return response.ok({
+              body: {
+                name: DEFAULT_ALERTS_INDEX,
+                index_mapping_outdated: false,
+              },
+            });
+          } else {
+            return siemResponse.error({
+              statusCode: 404,
+              body: 'index for this space does not exist',
+            });
+          }
         }
       } catch (err) {
         const error = transformError(err);
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/signal_aad_mapping.json b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/signal_aad_mapping.json
new file mode 100644
index 00000000000000..066fdbc87f9066
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/signal_aad_mapping.json
@@ -0,0 +1,93 @@
+{
+  "signal.ancestors.depth": "kibana.alert.ancestors.depth",
+  "signal.ancestors.id": "kibana.alert.ancestors.id",
+  "signal.ancestors.index": "kibana.alert.ancestors.index",
+  "signal.ancestors.type": "kibana.alert.ancestors.type",
+  "signal.depth": "kibana.alert.depth",
+  "signal.original_event.action": "kibana.alert.original_event.action",
+  "signal.original_event.category": "kibana.alert.original_event.category",
+  "signal.original_event.code": "kibana.alert.original_event.code",
+  "signal.original_event.created": "kibana.alert.original_event.created",
+  "signal.original_event.dataset": "kibana.alert.original_event.dataset",
+  "signal.original_event.duration": "kibana.alert.original_event.duration",
+  "signal.original_event.end": "kibana.alert.original_event.end",
+  "signal.original_event.hash": "kibana.alert.original_event.hash",
+  "signal.original_event.id": "kibana.alert.original_event.id",
+  "signal.original_event.kind": "kibana.alert.original_event.kind",
+  "signal.original_event.module": "kibana.alert.original_event.module",
+  "signal.original_event.outcome": "kibana.alert.original_event.outcome",
+  "signal.original_event.provider": "kibana.alert.original_event.provider",
+  "signal.original_event.risk_score": "kibana.alert.original_event.risk_score",
+  "signal.original_event.risk_score_norm": "kibana.alert.original_event.risk_score_norm",
+  "signal.original_event.sequence": "kibana.alert.original_event.sequence",
+  "signal.original_event.severity": "kibana.alert.original_event.severity",
+  "signal.original_event.start": "kibana.alert.original_event.start",
+  "signal.original_event.timezone": "kibana.alert.original_event.timezone",
+  "signal.original_event.type": "kibana.alert.original_event.type",
+  "signal.original_time": "kibana.alert.original_time",
+  "signal.rule.author": "kibana.alert.rule.author",
+  "signal.rule.building_block_type": "kibana.alert.rule.building_block_type",
+  "signal.rule.created_at": "kibana.alert.rule.created_at",
+  "signal.rule.created_by": "kibana.alert.rule.created_by",
+  "signal.rule.description": "kibana.alert.rule.description",
+  "signal.rule.enabled": "kibana.alert.rule.enabled",
+  "signal.rule.false_positives": "kibana.alert.rule.false_positives",
+  "signal.rule.from": "kibana.alert.rule.from",
+  "signal.rule.id": "kibana.alert.rule.id",
+  "signal.rule.immutable": "kibana.alert.rule.immutable",
+  "signal.rule.index": "kibana.alert.rule.index",
+  "signal.rule.interval": "kibana.alert.rule.interval",
+  "signal.rule.language": "kibana.alert.rule.language",
+  "signal.rule.license": "kibana.alert.rule.license",
+  "signal.rule.max_signals": "kibana.alert.rule.max_signals",
+  "signal.rule.name": "kibana.alert.rule.name",
+  "signal.rule.note": "kibana.alert.rule.note",
+  "signal.rule.query": "kibana.alert.rule.query",
+  "signal.rule.references": "kibana.alert.rule.references",
+  "signal.rule.risk_score": "kibana.alert.risk_score",
+  "signal.rule.risk_score_mapping.field": "kibana.alert.rule.risk_score_mapping.field",
+  "signal.rule.risk_score_mapping.operator": "kibana.alert.rule.risk_score_mapping.operator",
+  "signal.rule.risk_score_mapping.value": "kibana.alert.rule.risk_score_mapping.value",
+  "signal.rule.rule_id": "kibana.alert.rule.rule_id",
+  "signal.rule.rule_name_override": "kibana.alert.rule.rule_name_override",
+  "signal.rule.saved_id": "kibana.alert.rule.saved_id",
+  "signal.rule.severity": "kibana.alert.severity",
+  "signal.rule.severity_mapping.field": "kibana.alert.rule.severity_mapping.field",
+  "signal.rule.severity_mapping.operator": "kibana.alert.rule.severity_mapping.operator",
+  "signal.rule.severity_mapping.value": "kibana.alert.rule.severity_mapping.value",
+  "signal.rule.severity_mapping.severity": "kibana.alert.rule.severity_mapping.severity",
+  "signal.rule.tags": "kibana.alert.rule.tags",
+  "signal.rule.threat.framework": "kibana.alert.rule.threat.framework",
+  "signal.rule.threat.tactic.id": "kibana.alert.rule.threat.tactic.id",
+  "signal.rule.threat.tactic.name": "kibana.alert.rule.threat.tactic.name",
+  "signal.rule.threat.tactic.reference": "kibana.alert.rule.threat.tactic.reference",
+  "signal.rule.threat.technique.id": "kibana.alert.rule.threat.technique.id",
+  "signal.rule.threat.technique.name": "kibana.alert.rule.threat.technique.name",
+  "signal.rule.threat.technique.reference": "kibana.alert.rule.threat.technique.reference",
+  "signal.rule.threat.technique.subtechnique.id": "kibana.alert.rule.threat.technique.subtechnique.id",
+  "signal.rule.threat.technique.subtechnique.name": "kibana.alert.rule.threat.technique.subtechnique.name",
+  "signal.rule.threat.technique.subtechnique.reference": "kibana.alert.rule.threat.technique.subtechnique.reference",
+  "signal.rule.threat_index": "kibana.alert.rule.threat_index",
+  "signal.rule.threat_indicator_path": "kibana.alert.rule.threat_indicator_path",
+  "signal.rule.threat_language": "kibana.alert.rule.threat_language",
+  "signal.rule.threat_mapping.entries.field": "kibana.alert.rule.threat_mapping.entries.field",
+  "signal.rule.threat_mapping.entries.value": "kibana.alert.rule.threat_mapping.entries.value",
+  "signal.rule.threat_mapping.entries.type": "kibana.alert.rule.threat_mapping.entries.type",
+  "signal.rule.threat_query": "kibana.alert.rule.threat_query",
+  "signal.rule.threshold.field": "kibana.alert.rule.threshold.field",
+  "signal.rule.threshold.value": "kibana.alert.rule.threshold.value",
+  "signal.rule.timeline_id": "kibana.alert.rule.timeline_id",
+  "signal.rule.timeline_title": "kibana.alert.rule.timeline_title",
+  "signal.rule.to": "kibana.alert.rule.to",
+  "signal.rule.type": "kibana.alert.rule.type",
+  "signal.rule.updated_at": "kibana.alert.rule.updated_at",
+  "signal.rule.updated_by": "kibana.alert.rule.updated_by",
+  "signal.rule.version": "kibana.alert.rule.version",
+  "signal.status": "kibana.alert.workflow_status",
+  "signal.threshold_result.from": "kibana.alert.threshold_result.from",
+  "signal.threshold_result.terms.field": "kibana.alert.threshold_result.terms.field",
+  "signal.threshold_result.terms.value": "kibana.alert.threshold_result.terms.value",
+  "signal.threshold_result.cardinality.field": "kibana.alert.threshold_result.cardinality.field",
+  "signal.threshold_result.cardinality.value": "kibana.alert.threshold_result.cardinality.value",
+  "signal.threshold_result.count": "kibana.alert.threshold_result.count"
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/signal_extra_fields.json b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/signal_extra_fields.json
new file mode 100644
index 00000000000000..e20aa0ef16df43
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/signal_extra_fields.json
@@ -0,0 +1,195 @@
+{
+  "signal": {
+    "type": "object",
+    "properties": {
+      "_meta": {
+        "type": "object",
+        "properties": {
+          "version": {
+            "type": "long"
+          }
+        }
+      },
+      "ancestors": {
+        "properties": {
+          "rule": {
+            "type": "keyword"
+          },
+          "index": {
+            "type": "keyword"
+          },
+          "id": {
+            "type": "keyword"
+          },
+          "type": {
+            "type": "keyword"
+          },
+          "depth": {
+            "type": "long"
+          }
+        }
+      },
+      "depth": {
+        "type": "integer"
+      },
+      "group": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "keyword"
+          },
+          "index": {
+            "type": "integer"
+          }
+        }
+      },
+      "rule": {
+        "type": "object",
+        "properties": {
+          "author": {
+            "type": "keyword"
+          },
+          "building_block_type": {
+            "type": "keyword"
+          },
+          "license": {
+            "type": "keyword"
+          },
+          "note": {
+            "type": "text"
+          },
+          "risk_score_mapping": {
+            "type": "object",
+            "properties": {
+              "field": {
+                "type": "keyword"
+              },
+              "operator": {
+                "type": "keyword"
+              },
+              "value": {
+                "type": "keyword"
+              }
+            }
+          },
+          "rule_name_override": {
+            "type": "keyword"
+          },
+          "severity_mapping": {
+            "type": "object",
+            "properties": {
+              "field": {
+                "type": "keyword"
+              },
+              "operator": {
+                "type": "keyword"
+              },
+              "value": {
+                "type": "keyword"
+              },
+              "severity": {
+                "type": "keyword"
+              }
+            }
+          },
+          "threat": {
+            "type": "object",
+            "properties": {
+              "technique": {
+                "type": "object",
+                "properties": {
+                  "subtechnique": {
+                    "type": "object",
+                    "properties": {
+                      "id": {
+                        "type": "keyword"
+                      },
+                      "name": {
+                        "type": "keyword"
+                      },
+                      "reference": {
+                        "type": "keyword"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "threat_index": {
+            "type": "keyword"
+          },
+          "threat_indicator_path": {
+            "type": "keyword"
+          },
+          "threat_language": {
+            "type": "keyword"
+          },
+          "threat_mapping": {
+            "type": "object",
+            "properties": {
+              "entries": {
+                "type": "object",
+                "properties": {
+                  "field": {
+                    "type": "keyword"
+                  },
+                  "value": {
+                    "type": "keyword"
+                  },
+                  "type": {
+                    "type": "keyword"
+                  }
+                }
+              }
+            }
+          },
+          "threat_query": {
+            "type": "keyword"
+          },
+          "threshold": {
+            "type": "object",
+            "properties": {
+              "field": {
+                "type": "keyword"
+              },
+              "value": {
+                "type": "float"
+              }
+            }
+          }
+        }
+      },
+      "threshold_result": {
+        "properties": {
+          "from": {
+            "type": "date"
+          },
+          "terms": {
+            "properties": {
+              "field": {
+                "type": "keyword"
+              },
+              "value": {
+                "type": "keyword"
+              }
+            }
+          },
+          "cardinality": {
+            "properties": {
+              "field": {
+                "type": "keyword"
+              },
+              "value": {
+                "type": "long"
+              }
+            }
+          },
+          "count": {
+            "type": "long"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/adapters/rule_registry_dapter.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/adapters/rule_registry_adapter.ts
similarity index 76%
rename from x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/adapters/rule_registry_dapter.ts
rename to x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/adapters/rule_registry_adapter.ts
index 3f56b26d32a097..90574528a9338d 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/adapters/rule_registry_dapter.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/adapters/rule_registry_adapter.ts
@@ -6,17 +6,18 @@
  */
 
 import { merge } from 'lodash';
-import { RuleDataPluginService } from '../../../../../../rule_registry/server';
 import { RuleExecutionStatus } from '../../../../../common/detection_engine/schemas/common/schemas';
-import { IRuleStatusSOAttributes } from '../../rules/types';
 import { RuleRegistryLogClient } from '../rule_registry_log_client/rule_registry_log_client';
 import {
+  CreateExecutionLogArgs,
   ExecutionMetric,
   ExecutionMetricArgs,
   FindBulkExecutionLogArgs,
   FindExecutionLogArgs,
+  IRuleDataPluginService,
   IRuleExecutionLogClient,
   LogStatusChangeArgs,
+  UpdateExecutionLogArgs,
 } from '../types';
 
 /**
@@ -25,7 +26,7 @@ import {
 export class RuleRegistryAdapter implements IRuleExecutionLogClient {
   private ruleRegistryClient: RuleRegistryLogClient;
 
-  constructor(ruleDataService: RuleDataPluginService) {
+  constructor(ruleDataService: IRuleDataPluginService) {
     this.ruleRegistryClient = new RuleRegistryLogClient(ruleDataService);
   }
 
@@ -58,37 +59,45 @@ export class RuleRegistryAdapter implements IRuleExecutionLogClient {
     return merge(statusesById, lastErrorsById);
   }
 
-  public async create(event: IRuleStatusSOAttributes, spaceId: string) {
-    if (event.status) {
+  public async create({ attributes, spaceId }: CreateExecutionLogArgs) {
+    if (attributes.status) {
       await this.ruleRegistryClient.logStatusChange({
-        ruleId: event.alertId,
-        newStatus: event.status,
+        ruleId: attributes.alertId,
+        newStatus: attributes.status,
         spaceId,
       });
     }
 
-    if (event.bulkCreateTimeDurations) {
+    if (attributes.bulkCreateTimeDurations) {
       await this.ruleRegistryClient.logExecutionMetric({
-        ruleId: event.alertId,
+        ruleId: attributes.alertId,
         metric: ExecutionMetric.indexingDurationMax,
-        value: Math.max(...event.bulkCreateTimeDurations.map(Number)),
+        value: Math.max(...attributes.bulkCreateTimeDurations.map(Number)),
         spaceId,
       });
     }
 
-    if (event.gap) {
+    if (attributes.gap) {
       await this.ruleRegistryClient.logExecutionMetric({
-        ruleId: event.alertId,
+        ruleId: attributes.alertId,
         metric: ExecutionMetric.executionGap,
-        value: Number(event.gap),
+        value: Number(attributes.gap),
         spaceId,
       });
     }
+
+    return {
+      id: '',
+      type: '',
+      score: 0,
+      attributes,
+      references: [],
+    };
   }
 
-  public async update(id: string, event: IRuleStatusSOAttributes, spaceId: string) {
+  public async update({ attributes, spaceId }: UpdateExecutionLogArgs) {
     // execution events are immutable, so we just use 'create' here instead of 'update'
-    await this.create(event, spaceId);
+    await this.create({ attributes, spaceId });
   }
 
   public async delete(id: string) {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/adapters/saved_objects_adapter.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/adapters/saved_objects_adapter.ts
index 55f65caf34b037..444e11dc5b9f09 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/adapters/saved_objects_adapter.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/adapters/saved_objects_adapter.ts
@@ -6,18 +6,19 @@
  */
 
 import { SavedObjectsClientContract } from '../../../../../../../../src/core/server';
-import { IRuleStatusSOAttributes } from '../../rules/types';
 import {
   RuleStatusSavedObjectsClient,
   ruleStatusSavedObjectsClientFactory,
 } from '../../signals/rule_status_saved_objects_client';
 import {
+  CreateExecutionLogArgs,
   ExecutionMetric,
   ExecutionMetricArgs,
   FindBulkExecutionLogArgs,
   FindExecutionLogArgs,
   IRuleExecutionLogClient,
   LogStatusChangeArgs,
+  UpdateExecutionLogArgs,
 } from '../types';
 
 export class SavedObjectsAdapter implements IRuleExecutionLogClient {
@@ -41,12 +42,12 @@ export class SavedObjectsAdapter implements IRuleExecutionLogClient {
     return this.ruleStatusClient.findBulk(ruleIds, logsCount);
   }
 
-  public async create(event: IRuleStatusSOAttributes) {
-    await this.ruleStatusClient.create(event);
+  public async create({ attributes }: CreateExecutionLogArgs) {
+    return this.ruleStatusClient.create(attributes);
   }
 
-  public async update(id: string, event: IRuleStatusSOAttributes) {
-    await this.ruleStatusClient.update(id, event);
+  public async update({ id, attributes }: UpdateExecutionLogArgs) {
+    await this.ruleStatusClient.update(id, attributes);
   }
 
   public async delete(id: string) {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_execution_log_client.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_execution_log_client.ts
index 286238b292cb71..26b36c367bda68 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_execution_log_client.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_execution_log_client.ts
@@ -6,21 +6,22 @@
  */
 
 import { SavedObjectsClientContract } from '../../../../../../../src/core/server';
-import { RuleDataPluginService } from '../../../../../rule_registry/server';
-import { IRuleStatusSOAttributes } from '../rules/types';
-import { RuleRegistryAdapter } from './adapters/rule_registry_dapter';
+import { RuleRegistryAdapter } from './adapters/rule_registry_adapter';
 import { SavedObjectsAdapter } from './adapters/saved_objects_adapter';
 import {
+  CreateExecutionLogArgs,
   ExecutionMetric,
   ExecutionMetricArgs,
   FindBulkExecutionLogArgs,
   FindExecutionLogArgs,
+  IRuleDataPluginService,
   IRuleExecutionLogClient,
   LogStatusChangeArgs,
+  UpdateExecutionLogArgs,
 } from './types';
 
 export interface RuleExecutionLogClientArgs {
-  ruleDataService: RuleDataPluginService;
+  ruleDataService: IRuleDataPluginService;
   savedObjectsClient: SavedObjectsClientContract;
 }
 
@@ -45,14 +46,12 @@ export class RuleExecutionLogClient implements IRuleExecutionLogClient {
     return this.client.findBulk(args);
   }
 
-  // TODO args as an object
-  public async create(event: IRuleStatusSOAttributes, spaceId: string) {
-    return this.client.create(event, spaceId);
+  public async create(args: CreateExecutionLogArgs) {
+    return this.client.create(args);
   }
 
-  // TODO args as an object
-  public async update(id: string, event: IRuleStatusSOAttributes, spaceId: string) {
-    return this.client.update(id, event, spaceId);
+  public async update(args: UpdateExecutionLogArgs) {
+    return this.client.update(args);
   }
 
   public async delete(id: string) {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_registry_log_client/rule_execution_log_bootstrapper.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_registry_log_client/rule_execution_log_bootstrapper.ts
index 9b13fbb1d21d66..2c10811b21c48e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_registry_log_client/rule_execution_log_bootstrapper.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_registry_log_client/rule_execution_log_bootstrapper.ts
@@ -7,14 +7,14 @@
 
 import { TECHNICAL_COMPONENT_TEMPLATE_NAME } from '../../../../../../rule_registry/common/assets';
 import { mappingFromFieldMap } from '../../../../../../rule_registry/common/mapping_from_field_map';
-import { RuleDataPluginService } from '../../../../../../rule_registry/server';
+import { IRuleDataPluginService } from '../types';
 import { ruleExecutionFieldMap } from './rule_execution_field_map';
 
 /**
  * @deprecated bootstrapRuleExecutionLog is kept here only as a reference. It will be superseded with EventLog implementation
  */
 export const bootstrapRuleExecutionLog = async (
-  ruleDataService: RuleDataPluginService,
+  ruleDataService: IRuleDataPluginService,
   indexAlias: string
 ) => {
   const indexPattern = `${indexAlias}*`;
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_registry_log_client/rule_registry_log_client.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_registry_log_client/rule_registry_log_client.ts
index 5094f9a8c6e3ce..e2c5c98702f12b 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_registry_log_client/rule_registry_log_client.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/rule_registry_log_client/rule_registry_log_client.ts
@@ -6,20 +6,32 @@
  */
 
 import { estypes } from '@elastic/elasticsearch';
-import { EVENT_ACTION, EVENT_KIND, RULE_ID, SPACE_IDS, TIMESTAMP } from '@kbn/rule-data-utils';
+import {
+  ALERT_OWNER,
+  EVENT_ACTION,
+  EVENT_KIND,
+  RULE_ID,
+  SPACE_IDS,
+  TIMESTAMP,
+} from '@kbn/rule-data-utils';
 import { once } from 'lodash/fp';
 import moment from 'moment';
-import { RuleDataClient, RuleDataPluginService } from '../../../../../../rule_registry/server';
+import { RuleDataClient } from '../../../../../../rule_registry/server';
 import { SERVER_APP_ID } from '../../../../../common/constants';
 import { RuleExecutionStatus } from '../../../../../common/detection_engine/schemas/common/schemas';
 import { invariant } from '../../../../../common/utils/invariant';
 import { IRuleStatusSOAttributes } from '../../rules/types';
 import { makeFloatString } from '../../signals/utils';
-import { ExecutionMetric, ExecutionMetricArgs, LogStatusChangeArgs } from '../types';
+import {
+  ExecutionMetric,
+  ExecutionMetricArgs,
+  IRuleDataPluginService,
+  LogStatusChangeArgs,
+} from '../types';
 import {
   EVENTS_INDEX_PREFIX,
-  MESSAGE,
   EVENT_SEQUENCE,
+  MESSAGE,
   RULE_STATUS,
   RULE_STATUS_SEVERITY,
 } from './constants';
@@ -65,7 +77,7 @@ export class RuleRegistryLogClient implements IRuleRegistryLogClient {
   private sequence = 0;
   private ruleDataClient: RuleDataClient;
 
-  constructor(ruleDataService: RuleDataPluginService) {
+  constructor(ruleDataService: IRuleDataPluginService) {
     this.ruleDataClient = ruleDataService.getRuleDataClient(
       SERVER_APP_ID,
       EVENTS_INDEX_PREFIX,
@@ -73,7 +85,7 @@ export class RuleRegistryLogClient implements IRuleRegistryLogClient {
     );
   }
 
-  private initialize = once(async (ruleDataService: RuleDataPluginService, indexAlias: string) => {
+  private initialize = once(async (ruleDataService: IRuleDataPluginService, indexAlias: string) => {
     await bootstrapRuleExecutionLog(ruleDataService, indexAlias);
   });
 
@@ -216,6 +228,7 @@ export class RuleRegistryLogClient implements IRuleRegistryLogClient {
         [getMetricField(metric)]: value,
         [RULE_ID]: ruleId,
         [TIMESTAMP]: new Date().toISOString(),
+        [ALERT_OWNER]: 'siem',
       },
       namespace
     );
@@ -239,6 +252,7 @@ export class RuleRegistryLogClient implements IRuleRegistryLogClient {
         [RULE_STATUS_SEVERITY]: statusSeverityDict[newStatus],
         [RULE_STATUS]: newStatus,
         [TIMESTAMP]: new Date().toISOString(),
+        [ALERT_OWNER]: 'siem',
       },
       namespace
     );
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/types.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/types.ts
index ca589fd1d584fc..42b9a3bbd66cce 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/types.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/types.ts
@@ -5,7 +5,9 @@
  * 2.0.
  */
 
-import { SavedObjectsFindResult } from '../../../../../../../src/core/server';
+import { PublicMethodsOf } from '@kbn/utility-types';
+import { SavedObject, SavedObjectsFindResult } from '../../../../../../../src/core/server';
+import { RuleDataPluginService } from '../../../../../rule_registry/server';
 import { RuleExecutionStatus } from '../../../../common/detection_engine/schemas/common/schemas';
 import { IRuleStatusSOAttributes } from '../rules/types';
 
@@ -16,6 +18,8 @@ export enum ExecutionMetric {
   'indexingLookback' = 'indexingLookback',
 }
 
+export type IRuleDataPluginService = PublicMethodsOf<RuleDataPluginService>;
+
 export type ExecutionMetricValue<T extends ExecutionMetric> = {
   [ExecutionMetric.executionGap]: number;
   [ExecutionMetric.searchDurationMax]: number;
@@ -43,6 +47,17 @@ export interface LogStatusChangeArgs {
   message?: string;
 }
 
+export interface UpdateExecutionLogArgs {
+  id: string;
+  attributes: IRuleStatusSOAttributes;
+  spaceId: string;
+}
+
+export interface CreateExecutionLogArgs {
+  attributes: IRuleStatusSOAttributes;
+  spaceId: string;
+}
+
 export interface ExecutionMetricArgs<T extends ExecutionMetric> {
   ruleId: string;
   spaceId: string;
@@ -60,8 +75,8 @@ export interface IRuleExecutionLogClient {
     args: FindExecutionLogArgs
   ) => Promise<Array<SavedObjectsFindResult<IRuleStatusSOAttributes>>>;
   findBulk: (args: FindBulkExecutionLogArgs) => Promise<FindBulkExecutionLogResponse>;
-  create: (event: IRuleStatusSOAttributes, spaceId: string) => Promise<void>;
-  update: (id: string, event: IRuleStatusSOAttributes, spaceId: string) => Promise<void>;
+  create: (args: CreateExecutionLogArgs) => Promise<SavedObject<IRuleStatusSOAttributes>>;
+  update: (args: UpdateExecutionLogArgs) => Promise<void>;
   delete: (id: string) => Promise<void>;
   // TODO These methods are intended to supersede ones provided by RuleStatusService
   logStatusChange: (args: LogStatusChangeArgs) => Promise<void>;
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/with_rule_execution_log.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/with_rule_execution_log.ts
index 95598ea943d8f3..a78001ee4f674c 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/with_rule_execution_log.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_execution_log/with_rule_execution_log.ts
@@ -11,10 +11,10 @@ import {
   AlertTypeParams,
   AlertTypeState,
 } from '../../../../../alerting/common';
-import { AlertTypeWithExecutor, RuleDataPluginService } from '../../../../../rule_registry/server';
+import { AlertTypeWithExecutor } from '../../../../../rule_registry/server';
 import { RuleExecutionStatus } from '../../../../common/detection_engine/schemas/common/schemas';
 import { RuleExecutionLogClient } from './rule_execution_log_client';
-import { IRuleExecutionLogClient } from './types';
+import { IRuleDataPluginService, IRuleExecutionLogClient } from './types';
 
 export interface ExecutionLogServices {
   ruleExecutionLogClient: IRuleExecutionLogClient;
@@ -23,7 +23,7 @@ export interface ExecutionLogServices {
 
 type WithRuleExecutionLog = (args: {
   logger: Logger;
-  ruleDataService: RuleDataPluginService;
+  ruleDataService: IRuleDataPluginService;
 }) => <
   TState extends AlertTypeState,
   TParams extends AlertTypeParams,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/__mocks__/rule_type.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/__mocks__/rule_type.ts
index 60dcbb3a4e77e7..0fa2bcc270a167 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/__mocks__/rule_type.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/__mocks__/rule_type.ts
@@ -17,6 +17,7 @@ import { ConfigType } from '../../../../config';
 import { AlertAttributes } from '../../signals/types';
 import { createRuleMock } from './rule';
 import { listMock } from '../../../../../../lists/server/mocks';
+import { ruleRegistryMocks } from '../../../../../../rule_registry/server/mocks';
 
 export const createRuleTypeMocks = () => {
   /* eslint-disable @typescript-eslint/no-explicit-any */
@@ -85,6 +86,7 @@ export const createRuleTypeMocks = () => {
         })),
         isWriteEnabled: jest.fn(() => true),
       } as unknown) as RuleDataClient,
+      ruleDataService: ruleRegistryMocks.createRuleDataPluginService(),
     },
     services,
     scheduleActions,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_factory.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_factory.ts
index 71d922ed543c18..168502d120b8fb 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_factory.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_factory.ts
@@ -12,7 +12,6 @@ import { parseScheduleDates } from '@kbn/securitysolution-io-ts-utils';
 import { ListArray } from '@kbn/securitysolution-io-ts-list-types';
 import { toError } from '@kbn/securitysolution-list-api';
 import { createPersistenceRuleTypeFactory } from '../../../../../rule_registry/server';
-import { ruleStatusSavedObjectsClientFactory } from '../signals/rule_status_saved_objects_client';
 import { ruleStatusServiceFactory } from '../signals/rule_status_service';
 import { buildRuleMessageFactory } from './factories/build_rule_message_factory';
 import {
@@ -33,6 +32,7 @@ import {
 import { getNotificationResultsLink } from '../notifications/utils';
 import { createResultObject } from './utils';
 import { bulkCreateFactory, wrapHitsFactory } from './factories';
+import { RuleExecutionLogClient } from '../rule_execution_log/rule_execution_log_client';
 
 /* eslint-disable complexity */
 export const createSecurityRuleTypeFactory: CreateSecurityRuleTypeFactory = ({
@@ -41,6 +41,7 @@ export const createSecurityRuleTypeFactory: CreateSecurityRuleTypeFactory = ({
   logger,
   mergeStrategy,
   ruleDataClient,
+  ruleDataService,
 }) => (type) => {
   const persistenceRuleType = createPersistenceRuleTypeFactory({ ruleDataClient, logger });
   return persistenceRuleType({
@@ -62,8 +63,9 @@ export const createSecurityRuleTypeFactory: CreateSecurityRuleTypeFactory = ({
 
       const esClient = scopedClusterClient.asCurrentUser;
 
-      const ruleStatusClient = ruleStatusSavedObjectsClientFactory(savedObjectsClient);
+      const ruleStatusClient = new RuleExecutionLogClient({ savedObjectsClient, ruleDataService });
       const ruleStatusService = await ruleStatusServiceFactory({
+        spaceId,
         alertId,
         ruleStatusClient,
       });
@@ -189,8 +191,10 @@ export const createSecurityRuleTypeFactory: CreateSecurityRuleTypeFactory = ({
         );
 
         const wrapHits = wrapHitsFactory({
-          ruleSO,
+          logger,
           mergeStrategy,
+          ruleSO,
+          spaceId,
         });
 
         for (const tuple of tuples) {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.test.ts
new file mode 100644
index 00000000000000..f9874478e7a5d3
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.test.ts
@@ -0,0 +1,419 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  ALERT_OWNER,
+  ALERT_RULE_NAMESPACE,
+  ALERT_STATUS,
+  ALERT_WORKFLOW_STATUS,
+  SPACE_IDS,
+} from '@kbn/rule-data-utils';
+
+import { sampleDocNoSortIdWithTimestamp } from '../../../signals/__mocks__/es_results';
+import { flattenWithPrefix } from './flatten_with_prefix';
+import {
+  buildAlert,
+  buildParent,
+  buildAncestors,
+  additionalAlertFields,
+  removeClashes,
+} from './build_alert';
+import { Ancestor, SignalSourceHit } from '../../../signals/types';
+import {
+  getRulesSchemaMock,
+  ANCHOR_DATE,
+} from '../../../../../../common/detection_engine/schemas/response/rules_schema.mocks';
+import { getListArrayMock } from '../../../../../../common/detection_engine/schemas/types/lists.mock';
+import {
+  ALERT_ANCESTORS,
+  ALERT_ORIGINAL_EVENT,
+  ALERT_ORIGINAL_TIME,
+} from '../../field_maps/field_names';
+import { SERVER_APP_ID } from '../../../../../../common/constants';
+
+type SignalDoc = SignalSourceHit & {
+  _source: Required<SignalSourceHit>['_source'] & { '@timestamp': string };
+};
+
+const SPACE_ID = 'space';
+
+describe('buildAlert', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  test('it builds an alert as expected without original_event if event does not exist', () => {
+    const doc = sampleDocNoSortIdWithTimestamp('d5e8eb51-a6a0-456d-8a15-4b79bfec3d71');
+    delete doc._source.event;
+    const rule = getRulesSchemaMock();
+    const alert = {
+      ...buildAlert([doc], rule, SPACE_ID),
+      ...additionalAlertFields(doc),
+    };
+    const timestamp = alert['@timestamp'];
+    const expected = {
+      '@timestamp': timestamp,
+      [SPACE_IDS]: [SPACE_ID],
+      [ALERT_OWNER]: SERVER_APP_ID,
+      [ALERT_ANCESTORS]: [
+        {
+          id: 'd5e8eb51-a6a0-456d-8a15-4b79bfec3d71',
+          type: 'event',
+          index: 'myFakeSignalIndex',
+          depth: 0,
+        },
+      ],
+      [ALERT_ORIGINAL_TIME]: '2020-04-20T21:27:45.000Z',
+      [ALERT_STATUS]: 'open',
+      [ALERT_WORKFLOW_STATUS]: 'open',
+      ...flattenWithPrefix(ALERT_RULE_NAMESPACE, {
+        author: [],
+        id: '7a7065d7-6e8b-4aae-8d20-c93613dec9f9',
+        created_at: new Date(ANCHOR_DATE).toISOString(),
+        updated_at: new Date(ANCHOR_DATE).toISOString(),
+        created_by: 'elastic',
+        description: 'some description',
+        enabled: true,
+        false_positives: ['false positive 1', 'false positive 2'],
+        from: 'now-6m',
+        immutable: false,
+        name: 'Query with a rule id',
+        query: 'user.name: root or user.name: admin',
+        references: ['test 1', 'test 2'],
+        severity: 'high',
+        severity_mapping: [],
+        updated_by: 'elastic_kibana',
+        tags: ['some fake tag 1', 'some fake tag 2'],
+        to: 'now',
+        type: 'query',
+        threat: [],
+        version: 1,
+        status: 'succeeded',
+        status_date: '2020-02-22T16:47:50.047Z',
+        last_success_at: '2020-02-22T16:47:50.047Z',
+        last_success_message: 'succeeded',
+        output_index: '.siem-signals-default',
+        max_signals: 100,
+        risk_score: 55,
+        risk_score_mapping: [],
+        language: 'kuery',
+        rule_id: 'query-rule-id',
+        interval: '5m',
+        exceptions_list: getListArrayMock(),
+      }),
+      'kibana.alert.depth': 1,
+    };
+    expect(alert).toEqual(expected);
+  });
+
+  test('it builds an alert as expected with original_event if is present', () => {
+    const doc = sampleDocNoSortIdWithTimestamp('d5e8eb51-a6a0-456d-8a15-4b79bfec3d71');
+    doc._source.event = {
+      action: 'socket_opened',
+      dataset: 'socket',
+      kind: 'event',
+      module: 'system',
+    };
+    const rule = getRulesSchemaMock();
+    const alert = {
+      ...buildAlert([doc], rule, SPACE_ID),
+      ...additionalAlertFields(doc),
+    };
+    const timestamp = alert['@timestamp'];
+    const expected = {
+      '@timestamp': timestamp,
+      [SPACE_IDS]: [SPACE_ID],
+      [ALERT_OWNER]: SERVER_APP_ID,
+      [ALERT_ANCESTORS]: [
+        {
+          id: 'd5e8eb51-a6a0-456d-8a15-4b79bfec3d71',
+          type: 'event',
+          index: 'myFakeSignalIndex',
+          depth: 0,
+        },
+      ],
+      [ALERT_ORIGINAL_TIME]: '2020-04-20T21:27:45.000Z',
+      [ALERT_ORIGINAL_EVENT]: {
+        action: 'socket_opened',
+        dataset: 'socket',
+        kind: 'event',
+        module: 'system',
+      },
+      [ALERT_STATUS]: 'open',
+      [ALERT_WORKFLOW_STATUS]: 'open',
+      ...flattenWithPrefix(ALERT_RULE_NAMESPACE, {
+        author: [],
+        id: '7a7065d7-6e8b-4aae-8d20-c93613dec9f9',
+        created_at: new Date(ANCHOR_DATE).toISOString(),
+        updated_at: new Date(ANCHOR_DATE).toISOString(),
+        created_by: 'elastic',
+        description: 'some description',
+        enabled: true,
+        false_positives: ['false positive 1', 'false positive 2'],
+        from: 'now-6m',
+        immutable: false,
+        name: 'Query with a rule id',
+        query: 'user.name: root or user.name: admin',
+        references: ['test 1', 'test 2'],
+        severity: 'high',
+        severity_mapping: [],
+        updated_by: 'elastic_kibana',
+        tags: ['some fake tag 1', 'some fake tag 2'],
+        to: 'now',
+        type: 'query',
+        threat: [],
+        version: 1,
+        status: 'succeeded',
+        status_date: '2020-02-22T16:47:50.047Z',
+        last_success_at: '2020-02-22T16:47:50.047Z',
+        last_success_message: 'succeeded',
+        output_index: '.siem-signals-default',
+        max_signals: 100,
+        risk_score: 55,
+        risk_score_mapping: [],
+        language: 'kuery',
+        rule_id: 'query-rule-id',
+        interval: '5m',
+        exceptions_list: getListArrayMock(),
+      }),
+      'kibana.alert.depth': 1,
+    };
+    expect(alert).toEqual(expected);
+  });
+
+  test('it builds an ancestor correctly if the parent does not exist', () => {
+    const doc = sampleDocNoSortIdWithTimestamp('d5e8eb51-a6a0-456d-8a15-4b79bfec3d71');
+    doc._source.event = {
+      action: 'socket_opened',
+      dataset: 'socket',
+      kind: 'event',
+      module: 'system',
+    };
+    const parent = buildParent(doc);
+    const expected: Ancestor = {
+      id: 'd5e8eb51-a6a0-456d-8a15-4b79bfec3d71',
+      type: 'event',
+      index: 'myFakeSignalIndex',
+      depth: 0,
+    };
+    expect(parent).toEqual(expected);
+  });
+
+  test('it builds an ancestor correctly if the parent does exist', () => {
+    const doc = sampleDocNoSortIdWithTimestamp('d5e8eb51-a6a0-456d-8a15-4b79bfec3d71');
+    doc._source.event = {
+      action: 'socket_opened',
+      dataset: 'socket',
+      kind: 'event',
+      module: 'system',
+    };
+    doc._source.signal = {
+      parents: [
+        {
+          id: '730ddf9e-5a00-4f85-9ddf-5878ca511a87',
+          type: 'event',
+          index: 'myFakeSignalIndex',
+          depth: 0,
+        },
+      ],
+      ancestors: [
+        {
+          id: '730ddf9e-5a00-4f85-9ddf-5878ca511a87',
+          type: 'event',
+          index: 'myFakeSignalIndex',
+          depth: 0,
+        },
+      ],
+      depth: 1,
+      rule: {
+        id: '98c0bf9e-4d38-46f4-9a6a-8a820426256b',
+      },
+    };
+    const parent = buildParent(doc);
+    const expected: Ancestor = {
+      rule: '98c0bf9e-4d38-46f4-9a6a-8a820426256b',
+      id: 'd5e8eb51-a6a0-456d-8a15-4b79bfec3d71',
+      type: 'signal',
+      index: 'myFakeSignalIndex',
+      depth: 1,
+    };
+    expect(parent).toEqual(expected);
+  });
+
+  test('it builds an alert ancestor correctly if the parent does not exist', () => {
+    const sampleDoc = sampleDocNoSortIdWithTimestamp('d5e8eb51-a6a0-456d-8a15-4b79bfec3d71');
+    const doc: SignalDoc = {
+      ...sampleDoc,
+      _source: {
+        ...sampleDoc._source,
+        '@timestamp': new Date().toISOString(),
+      },
+    };
+    doc._source.event = {
+      action: 'socket_opened',
+      dataset: 'socket',
+      kind: 'event',
+      module: 'system',
+    };
+    const ancestor = buildAncestors(doc);
+    const expected: Ancestor[] = [
+      {
+        id: 'd5e8eb51-a6a0-456d-8a15-4b79bfec3d71',
+        type: 'event',
+        index: 'myFakeSignalIndex',
+        depth: 0,
+      },
+    ];
+    expect(ancestor).toEqual(expected);
+  });
+
+  test('it builds an alert ancestor correctly if the parent does exist', () => {
+    const sampleDoc = sampleDocNoSortIdWithTimestamp('d5e8eb51-a6a0-456d-8a15-4b79bfec3d71');
+    const doc: SignalDoc = {
+      ...sampleDoc,
+      _source: {
+        ...sampleDoc._source,
+        '@timestamp': new Date().toISOString(),
+      },
+    };
+    doc._source.event = {
+      action: 'socket_opened',
+      dataset: 'socket',
+      kind: 'event',
+      module: 'system',
+    };
+    doc._source.signal = {
+      parents: [
+        {
+          id: '730ddf9e-5a00-4f85-9ddf-5878ca511a87',
+          type: 'event',
+          index: 'myFakeSignalIndex',
+          depth: 0,
+        },
+      ],
+      ancestors: [
+        {
+          id: '730ddf9e-5a00-4f85-9ddf-5878ca511a87',
+          type: 'event',
+          index: 'myFakeSignalIndex',
+          depth: 0,
+        },
+      ],
+      rule: {
+        id: '98c0bf9e-4d38-46f4-9a6a-8a820426256b',
+      },
+      depth: 1,
+    };
+    const ancestors = buildAncestors(doc);
+    const expected: Ancestor[] = [
+      {
+        id: '730ddf9e-5a00-4f85-9ddf-5878ca511a87',
+        type: 'event',
+        index: 'myFakeSignalIndex',
+        depth: 0,
+      },
+      {
+        rule: '98c0bf9e-4d38-46f4-9a6a-8a820426256b',
+        id: 'd5e8eb51-a6a0-456d-8a15-4b79bfec3d71',
+        type: 'signal',
+        index: 'myFakeSignalIndex',
+        depth: 1,
+      },
+    ];
+    expect(ancestors).toEqual(expected);
+  });
+
+  describe('removeClashes', () => {
+    test('it will call renameClashes with a regular doc and not mutate it if it does not have a signal clash', () => {
+      const sampleDoc = sampleDocNoSortIdWithTimestamp('d5e8eb51-a6a0-456d-8a15-4b79bfec3d71');
+      const doc: SignalDoc = {
+        ...sampleDoc,
+        _source: {
+          ...sampleDoc._source,
+          '@timestamp': new Date().toISOString(),
+        },
+      };
+      const output = removeClashes(doc);
+      expect(output).toBe(doc); // reference check
+    });
+
+    test('it will call renameClashes with a regular doc and not change anything', () => {
+      const sampleDoc = sampleDocNoSortIdWithTimestamp('d5e8eb51-a6a0-456d-8a15-4b79bfec3d71');
+      const doc: SignalDoc = {
+        ...sampleDoc,
+        _source: {
+          ...sampleDoc._source,
+          '@timestamp': new Date().toISOString(),
+        },
+      };
+      const output = removeClashes(doc);
+      expect(output).toEqual(doc); // deep equal check
+    });
+
+    test('it will remove a "signal" numeric clash', () => {
+      const sampleDoc = sampleDocNoSortIdWithTimestamp('d5e8eb51-a6a0-456d-8a15-4b79bfec3d71');
+      const doc = ({
+        ...sampleDoc,
+        _source: {
+          ...sampleDoc._source,
+          signal: 127,
+        },
+      } as unknown) as SignalDoc;
+      const output = removeClashes(doc);
+      const timestamp = output._source['@timestamp'];
+      expect(output).toEqual({
+        ...sampleDoc,
+        _source: {
+          ...sampleDoc._source,
+          '@timestamp': timestamp,
+        },
+      });
+    });
+
+    test('it will remove a "signal" object clash', () => {
+      const sampleDoc = sampleDocNoSortIdWithTimestamp('d5e8eb51-a6a0-456d-8a15-4b79bfec3d71');
+      const doc = ({
+        ...sampleDoc,
+        _source: {
+          ...sampleDoc._source,
+          signal: { child_1: { child_2: 'Test nesting' } },
+        },
+      } as unknown) as SignalDoc;
+      const output = removeClashes(doc);
+      const timestamp = output._source['@timestamp'];
+      expect(output).toEqual({
+        ...sampleDoc,
+        _source: {
+          ...sampleDoc._source,
+          '@timestamp': timestamp,
+        },
+      });
+    });
+
+    test('it will not remove a "signal" if that is signal is one of our signals', () => {
+      const sampleDoc = sampleDocNoSortIdWithTimestamp('d5e8eb51-a6a0-456d-8a15-4b79bfec3d71');
+      const doc = ({
+        ...sampleDoc,
+        _source: {
+          ...sampleDoc._source,
+          signal: { rule: { id: '123' } },
+        },
+      } as unknown) as SignalDoc;
+      const output = removeClashes(doc);
+      const timestamp = output._source['@timestamp'];
+      const expected = {
+        ...sampleDoc,
+        _source: {
+          ...sampleDoc._source,
+          signal: { rule: { id: '123' } },
+          '@timestamp': timestamp,
+        },
+      };
+      expect(output).toEqual(expected);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.ts
index fbd033a7f4ec48..641b37cb54bc40 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.ts
@@ -5,124 +5,113 @@
  * 2.0.
  */
 
-import { ALERT_STATUS, ALERT_WORKFLOW_STATUS } from '@kbn/rule-data-utils';
-import { SearchTypes } from '../../../../../../common/detection_engine/types';
+import {
+  ALERT_OWNER,
+  ALERT_RULE_NAMESPACE,
+  ALERT_STATUS,
+  ALERT_WORKFLOW_STATUS,
+  SPACE_IDS,
+} from '@kbn/rule-data-utils';
 import { RulesSchema } from '../../../../../../common/detection_engine/schemas/response/rules_schema';
 import { isEventTypeSignal } from '../../../signals/build_event_type_signal';
+import { Ancestor, BaseSignalHit, SimpleHit } from '../../../signals/types';
 import {
-  Ancestor,
-  BaseSignalHit,
-  SignalHit,
-  SignalSourceHit,
-  ThresholdResult,
-} from '../../../signals/types';
-import { getValidDateFromDoc } from '../../../signals/utils';
+  getField,
+  getValidDateFromDoc,
+  isWrappedRACAlert,
+  isWrappedSignalHit,
+} from '../../../signals/utils';
 import { invariant } from '../../../../../../common/utils/invariant';
-import { DEFAULT_MAX_SIGNALS } from '../../../../../../common/constants';
+import { RACAlert } from '../../types';
+import { flattenWithPrefix } from './flatten_with_prefix';
+import {
+  ALERT_ANCESTORS,
+  ALERT_DEPTH,
+  ALERT_ORIGINAL_EVENT,
+  ALERT_ORIGINAL_TIME,
+} from '../../field_maps/field_names';
+import { SERVER_APP_ID } from '../../../../../../common/constants';
 
 /**
- * Takes a parent signal or event document and extracts the information needed for the corresponding entry in the child
- * signal's `signal.parents` array.
- * @param doc The parent signal or event
+ * Takes an event document and extracts the information needed for the corresponding entry in the child
+ * alert's ancestors array.
+ * @param doc The parent event
  */
-export const buildParent = (doc: BaseSignalHit): Ancestor => {
-  if (doc._source?.signal != null) {
-    return {
-      rule: doc._source?.signal.rule.id,
-      id: doc._id,
-      type: 'signal',
-      index: doc._index,
-      // We first look for signal.depth and use that if it exists. If it doesn't exist, this should be a pre-7.10 signal
-      // and should have signal.parent.depth instead. signal.parent.depth in this case is treated as equivalent to signal.depth.
-      depth: doc._source?.signal.depth ?? doc._source?.signal.parent?.depth ?? 1,
-    };
-  } else {
-    return {
-      id: doc._id,
-      type: 'event',
-      index: doc._index,
-      depth: 0,
-    };
+export const buildParent = (doc: SimpleHit): Ancestor => {
+  const isSignal: boolean = isWrappedSignalHit(doc) || isWrappedRACAlert(doc);
+  const parent: Ancestor = {
+    id: doc._id,
+    type: isSignal ? 'signal' : 'event',
+    index: doc._index,
+    depth: isSignal ? getField(doc, 'signal.depth') ?? 1 : 0,
+  };
+  if (isSignal) {
+    parent.rule = getField(doc, 'signal.rule.id');
   }
+  return parent;
 };
 
 /**
- * Takes a parent signal or event document with N ancestors and adds the parent document to the ancestry array,
+ * Takes a parent event document with N ancestors and adds the parent document to the ancestry array,
  * creating an array of N+1 ancestors.
- * @param doc The parent signal/event for which to extend the ancestry.
+ * @param doc The parent event for which to extend the ancestry.
  */
-export const buildAncestors = (doc: BaseSignalHit): Ancestor[] => {
+export const buildAncestors = (doc: SimpleHit): Ancestor[] => {
   const newAncestor = buildParent(doc);
-  const existingAncestors = doc._source?.signal?.ancestors;
-  if (existingAncestors != null) {
-    return [...existingAncestors, newAncestor];
-  } else {
-    return [newAncestor];
-  }
+  const existingAncestors: Ancestor[] = getField(doc, 'signal.ancestors') ?? [];
+  return [...existingAncestors, newAncestor];
 };
 
 /**
- * This removes any signal name clashes such as if a source index has
+ * This removes any alert name clashes such as if a source index has
  * "signal" but is not a signal object we put onto the object. If this
  * is our "signal object" then we don't want to remove it.
  * @param doc The source index doc to a signal.
  */
-export const removeClashes = (doc: BaseSignalHit): BaseSignalHit => {
-  invariant(doc._source, '_source field not found');
-  const { signal, ...noSignal } = doc._source;
-  if (signal == null || isEventTypeSignal(doc)) {
-    return doc;
-  } else {
-    return {
-      ...doc,
-      _source: { ...noSignal },
-    };
+export const removeClashes = (doc: SimpleHit) => {
+  if (isWrappedSignalHit(doc)) {
+    invariant(doc._source, '_source field not found');
+    const { signal, ...noSignal } = doc._source;
+    if (signal == null || isEventTypeSignal(doc)) {
+      return doc;
+    } else {
+      return {
+        ...doc,
+        _source: { ...noSignal },
+      };
+    }
   }
+  return doc;
 };
 
 /**
- * Builds the `signal.*` fields that are common across all signals.
- * @param docs The parent signals/events of the new signal to be built.
- * @param rule The rule that is generating the new signal.
+ * Builds the `kibana.alert.*` fields that are common across all alerts.
+ * @param docs The parent alerts/events of the new alert to be built.
+ * @param rule The rule that is generating the new alert.
  */
-export const buildAlert = (doc: SignalSourceHit, rule: RulesSchema) => {
-  const removedClashes = removeClashes(doc);
-  const parent = buildParent(removedClashes);
-  const ancestors = buildAncestors(removedClashes);
-  const immutable = doc._source?.signal?.rule.immutable ? 'true' : 'false';
-
-  const source = doc._source as SignalHit;
-  const signal = source?.signal;
-  const signalRule = signal?.rule;
+export const buildAlert = (
+  docs: SimpleHit[],
+  rule: RulesSchema,
+  spaceId: string | null | undefined
+): RACAlert => {
+  const removedClashes = docs.map(removeClashes);
+  const parents = removedClashes.map(buildParent);
+  const depth = parents.reduce((acc, parent) => Math.max(parent.depth, acc), 0) + 1;
+  const ancestors = removedClashes.reduce(
+    (acc: Ancestor[], doc) => acc.concat(buildAncestors(doc)),
+    []
+  );
 
-  return {
-    'kibana.alert.ancestors': ancestors as object[],
+  return ({
+    '@timestamp': new Date().toISOString(),
+    [ALERT_OWNER]: SERVER_APP_ID,
+    [SPACE_IDS]: spaceId != null ? [spaceId] : [],
+    [ALERT_ANCESTORS]: ancestors,
     [ALERT_STATUS]: 'open',
     [ALERT_WORKFLOW_STATUS]: 'open',
-    'kibana.alert.depth': parent.depth,
-    'kibana.alert.rule.false_positives': signalRule?.false_positives ?? [],
-    'kibana.alert.rule.id': rule.id,
-    'kibana.alert.rule.immutable': immutable,
-    'kibana.alert.rule.index': signalRule?.index ?? [],
-    'kibana.alert.rule.language': signalRule?.language ?? 'kuery',
-    'kibana.alert.rule.max_signals': signalRule?.max_signals ?? DEFAULT_MAX_SIGNALS,
-    'kibana.alert.rule.query': signalRule?.query ?? '*:*',
-    'kibana.alert.rule.saved_id': signalRule?.saved_id ?? '',
-    'kibana.alert.rule.threat_index': signalRule?.threat_index,
-    'kibana.alert.rule.threat_indicator_path': signalRule?.threat_indicator_path,
-    'kibana.alert.rule.threat_language': signalRule?.threat_language,
-    'kibana.alert.rule.threat_mapping.field': '', // TODO
-    'kibana.alert.rule.threat_mapping.value': '', // TODO
-    'kibana.alert.rule.threat_mapping.type': '', // TODO
-    'kibana.alert.rule.threshold.field': signalRule?.threshold?.field,
-    'kibana.alert.rule.threshold.value': signalRule?.threshold?.value,
-    'kibana.alert.rule.threshold.cardinality.field': '', // TODO
-    'kibana.alert.rule.threshold.cardinality.value': 0, // TODO
-  };
-};
-
-const isThresholdResult = (thresholdResult: SearchTypes): thresholdResult is ThresholdResult => {
-  return typeof thresholdResult === 'object';
+    [ALERT_DEPTH]: depth,
+    ...flattenWithPrefix(ALERT_RULE_NAMESPACE, rule),
+  } as unknown) as RACAlert;
 };
 
 /**
@@ -131,17 +120,16 @@ const isThresholdResult = (thresholdResult: SearchTypes): thresholdResult is Thr
  * @param doc The parent signal/event of the new signal to be built.
  */
 export const additionalAlertFields = (doc: BaseSignalHit) => {
-  const thresholdResult = doc._source?.threshold_result;
-  if (thresholdResult != null && !isThresholdResult(thresholdResult)) {
-    throw new Error(`threshold_result failed to validate: ${thresholdResult}`);
-  }
   const originalTime = getValidDateFromDoc({
     doc,
     timestampOverride: undefined,
   });
-  return {
-    'kibana.alert.original_time': originalTime != null ? originalTime.toISOString() : undefined,
-    'kibana.alert.original_event': doc._source?.event ?? undefined,
-    'kibana.alert.threshold_result': thresholdResult,
+  const additionalFields: Record<string, unknown> = {
+    [ALERT_ORIGINAL_TIME]: originalTime != null ? originalTime.toISOString() : undefined,
   };
+  const event = doc._source?.event;
+  if (event != null) {
+    additionalFields[ALERT_ORIGINAL_EVENT] = event;
+  }
+  return additionalFields;
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_bulk_body.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_bulk_body.ts
index 8c868ece26cebf..ca5857e0ee3958 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_bulk_body.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_bulk_body.ts
@@ -6,14 +6,21 @@
  */
 
 import { SavedObject } from 'src/core/types';
+import { BaseHit } from '../../../../../../common/detection_engine/types';
 import type { ConfigType } from '../../../../../config';
-import { buildRuleWithOverrides } from '../../../signals/build_rule';
+import { buildRuleWithOverrides, buildRuleWithoutOverrides } from '../../../signals/build_rule';
 import { getMergeStrategy } from '../../../signals/source_fields_merging/strategies';
-import { AlertAttributes, SignalSourceHit } from '../../../signals/types';
+import { AlertAttributes, SignalSource, SignalSourceHit } from '../../../signals/types';
 import { RACAlert } from '../../types';
 import { additionalAlertFields, buildAlert } from './build_alert';
 import { filterSource } from './filter_source';
 
+const isSourceDoc = (
+  hit: SignalSourceHit
+): hit is BaseHit<{ '@timestamp': string; _source: SignalSource }> => {
+  return hit._source != null;
+};
+
 /**
  * Formats the search_after result for insertion into the signals index. We first create a
  * "best effort" merged "fields" with the "_source" object, then build the signal object,
@@ -24,17 +31,25 @@ import { filterSource } from './filter_source';
  * @returns The body that can be added to a bulk call for inserting the signal.
  */
 export const buildBulkBody = (
+  spaceId: string | null | undefined,
   ruleSO: SavedObject<AlertAttributes>,
   doc: SignalSourceHit,
-  mergeStrategy: ConfigType['alertMergeStrategy']
+  mergeStrategy: ConfigType['alertMergeStrategy'],
+  applyOverrides: boolean
 ): RACAlert => {
   const mergedDoc = getMergeStrategy(mergeStrategy)({ doc });
-  const rule = buildRuleWithOverrides(ruleSO, mergedDoc._source ?? {});
+  const rule = applyOverrides
+    ? buildRuleWithOverrides(ruleSO, mergedDoc._source ?? {})
+    : buildRuleWithoutOverrides(ruleSO);
   const filteredSource = filterSource(mergedDoc);
-  return {
-    ...filteredSource,
-    ...buildAlert(mergedDoc, rule),
-    ...additionalAlertFields(mergedDoc),
-    '@timestamp': new Date().toISOString(),
-  };
+  if (isSourceDoc(mergedDoc)) {
+    return {
+      ...filteredSource,
+      ...buildAlert([mergedDoc], rule, spaceId),
+      ...additionalAlertFields(mergedDoc),
+      '@timestamp': new Date().toISOString(),
+    };
+  }
+
+  throw Error('Error building alert from source document.');
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/flatten_with_prefix.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/flatten_with_prefix.ts
new file mode 100644
index 00000000000000..d472dc5885e57d
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/flatten_with_prefix.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { SearchTypes } from '../../../../../../common/detection_engine/types';
+
+export const flattenWithPrefix = (
+  prefix: string,
+  obj: Record<string, SearchTypes>
+): Record<string, SearchTypes> => {
+  return Object.keys(obj).reduce((acc: Record<string, SearchTypes>, key) => {
+    return {
+      ...acc,
+      [`${prefix}.${key}`]: obj[key],
+    };
+  }, {});
+};
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/wrap_hits_factory.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/wrap_hits_factory.ts
index 620e599e7a4993..0b00b2f656379c 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/wrap_hits_factory.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/wrap_hits_factory.ts
@@ -5,6 +5,8 @@
  * 2.0.
  */
 
+import { Logger } from 'kibana/server';
+
 import { SearchAfterAndBulkCreateParams, SignalSourceHit, WrapHits } from '../../signals/types';
 import { buildBulkBody } from './utils/build_bulk_body';
 import { generateId } from '../../signals/utils';
@@ -13,24 +15,33 @@ import type { ConfigType } from '../../../../config';
 import { WrappedRACAlert } from '../types';
 
 export const wrapHitsFactory = ({
-  ruleSO,
+  logger,
   mergeStrategy,
+  ruleSO,
+  spaceId,
 }: {
+  logger: Logger;
   ruleSO: SearchAfterAndBulkCreateParams['ruleSO'];
   mergeStrategy: ConfigType['alertMergeStrategy'];
+  spaceId: string | null | undefined;
 }): WrapHits => (events) => {
-  const wrappedDocs: WrappedRACAlert[] = events.flatMap((doc) => [
-    {
-      _index: '',
-      _id: generateId(
-        doc._index,
-        doc._id,
-        String(doc._version),
-        ruleSO.attributes.params.ruleId ?? ''
-      ),
-      _source: buildBulkBody(ruleSO, doc as SignalSourceHit, mergeStrategy),
-    },
-  ]);
+  try {
+    const wrappedDocs: WrappedRACAlert[] = events.flatMap((doc) => [
+      {
+        _index: '',
+        _id: generateId(
+          doc._index,
+          doc._id,
+          String(doc._version),
+          ruleSO.attributes.params.ruleId ?? ''
+        ),
+        _source: buildBulkBody(spaceId, ruleSO, doc as SignalSourceHit, mergeStrategy, true),
+      },
+    ]);
 
-  return filterDuplicateSignals(ruleSO.id, wrappedDocs, true);
+    return filterDuplicateSignals(ruleSO.id, wrappedDocs, true);
+  } catch (error) {
+    logger.error(error);
+    return [];
+  }
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/alerts.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/alerts.ts
index 244905329f8ca2..7ab998fe16074c 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/alerts.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/alerts.ts
@@ -43,6 +43,21 @@ export const alertsFieldMap: FieldMap = {
     array: false,
     required: true,
   },
+  'kibana.alert.group': {
+    type: 'object',
+    array: false,
+    required: false,
+  },
+  'kibana.alert.group.id': {
+    type: 'keyword',
+    array: false,
+    required: false,
+  },
+  'kibana.alert.group.index': {
+    type: 'keyword',
+    array: false,
+    required: false,
+  },
   'kibana.alert.original_event': {
     type: 'object',
     array: false,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/field_names.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/field_names.ts
new file mode 100644
index 00000000000000..41b7e6b02c9c6d
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/field_names.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ALERT_NAMESPACE } from '@kbn/rule-data-utils';
+
+export const ALERT_ANCESTORS = `${ALERT_NAMESPACE}.ancestors`;
+export const ALERT_DEPTH = `${ALERT_NAMESPACE}.depth`;
+export const ALERT_ORIGINAL_EVENT = `${ALERT_NAMESPACE}.original_event`;
+export const ALERT_ORIGINAL_TIME = `${ALERT_NAMESPACE}.original_time`;
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/query/create_query_alert_type.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/query/create_query_alert_type.test.ts
index 0127477e4800ac..a5ecc92df8f27b 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/query/create_query_alert_type.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/query/create_query_alert_type.test.ts
@@ -41,6 +41,7 @@ describe('Custom query alerts', () => {
       logger: dependencies.logger,
       mergeStrategy: 'allFields',
       ruleDataClient: dependencies.ruleDataClient,
+      ruleDataService: dependencies.ruleDataService,
       version: '1.0.0',
     });
 
@@ -88,6 +89,7 @@ describe('Custom query alerts', () => {
       logger: dependencies.logger,
       mergeStrategy: 'allFields',
       ruleDataClient: dependencies.ruleDataClient,
+      ruleDataService: dependencies.ruleDataService,
       version: '1.0.0',
     });
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/query/create_query_alert_type.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/query/create_query_alert_type.ts
index 3321597d8268fb..c487d8c93119dd 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/query/create_query_alert_type.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/query/create_query_alert_type.ts
@@ -7,16 +7,14 @@
 
 import { Logger } from '@kbn/logging';
 import { validateNonExact } from '@kbn/securitysolution-io-ts-utils';
-
 import { PersistenceServices, RuleDataClient } from '../../../../../../rule_registry/server';
 import { QUERY_ALERT_TYPE_ID } from '../../../../../common/constants';
 import { ExperimentalFeatures } from '../../../../../common/experimental_features';
 import { ConfigType } from '../../../../config';
 import { SetupPlugins } from '../../../../plugin';
-
+import { IRuleDataPluginService } from '../../rule_execution_log/types';
 import { queryRuleParams, QueryRuleParams } from '../../schemas/rule_schemas';
 import { queryExecutor } from '../../signals/executors/query';
-
 import { createSecurityRuleTypeFactory } from '../create_security_rule_type_factory';
 
 export const createQueryAlertType = (createOptions: {
@@ -27,6 +25,7 @@ export const createQueryAlertType = (createOptions: {
   mergeStrategy: ConfigType['alertMergeStrategy'];
   ruleDataClient: RuleDataClient;
   version: string;
+  ruleDataService: IRuleDataPluginService;
 }) => {
   const {
     experimentalFeatures,
@@ -36,6 +35,7 @@ export const createQueryAlertType = (createOptions: {
     mergeStrategy,
     ruleDataClient,
     version,
+    ruleDataService,
   } = createOptions;
   const createSecurityRuleType = createSecurityRuleTypeFactory({
     indexAlias,
@@ -43,6 +43,7 @@ export const createQueryAlertType = (createOptions: {
     logger,
     mergeStrategy,
     ruleDataClient,
+    ruleDataService,
   });
   return createSecurityRuleType<QueryRuleParams, {}, PersistenceServices, {}>({
     id: QUERY_ALERT_TYPE_ID,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/types.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/types.ts
index dc4cbba680b256..20fb7213086008 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/types.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/types.ts
@@ -28,6 +28,7 @@ import {
 import { BaseHit } from '../../../../common/detection_engine/types';
 import { ConfigType } from '../../../config';
 import { SetupPlugins } from '../../../plugin';
+import { IRuleDataPluginService } from '../rule_execution_log/types';
 import { RuleParams } from '../schemas/rule_schemas';
 import { BuildRuleMessage } from '../signals/rule_messages';
 import { AlertAttributes, BulkCreate, WrapHits } from '../signals/types';
@@ -96,6 +97,7 @@ export type CreateSecurityRuleTypeFactory = (options: {
   logger: Logger;
   mergeStrategy: ConfigType['alertMergeStrategy'];
   ruleDataClient: RuleDataClient;
+  ruleDataService: IRuleDataPluginService;
 }) => <
   TParams extends RuleParams & { index: string[] | undefined },
   TAlertInstanceContext extends AlertInstanceContext,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/enable_rule.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/enable_rule.ts
index b727596cd3b025..c6a5c003802428 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/enable_rule.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/enable_rule.ts
@@ -42,13 +42,13 @@ export const enableRule = async ({
   // set current status for this rule to be 'going to run'
   if (ruleCurrentStatus && ruleCurrentStatus.length > 0) {
     const currentStatusToDisable = ruleCurrentStatus[0];
-    await ruleStatusClient.update(
-      currentStatusToDisable.id,
-      {
+    await ruleStatusClient.update({
+      id: currentStatusToDisable.id,
+      attributes: {
         ...currentStatusToDisable.attributes,
         status: RuleExecutionStatus['going to run'],
       },
-      spaceId
-    );
+      spaceId,
+    });
   }
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/__mocks__/es_results.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/__mocks__/es_results.ts
index 5f4a9f5f7a422d..ed93c41035dca3 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/__mocks__/es_results.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/__mocks__/es_results.ts
@@ -168,6 +168,22 @@ export const sampleDocNoSortId = (
   sort: [],
 });
 
+export const sampleDocNoSortIdWithTimestamp = (
+  someUuid: string = sampleIdGuid,
+  ip?: string
+): SignalSourceHit & {
+  _source: Required<SignalSourceHit>['_source'] & { '@timestamp': string };
+} => {
+  const doc = sampleDocNoSortId(someUuid, ip);
+  return {
+    ...doc,
+    _source: {
+      ...doc._source,
+      '@timestamp': new Date().toISOString(),
+    },
+  };
+};
+
 export const sampleDocSeverity = (severity?: unknown, fieldName?: string): SignalSourceHit => {
   const doc = {
     _index: 'myFakeSignalIndex',
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_bulk_body.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_bulk_body.ts
index 2e6f4b9303d897..54a41be5cbadeb 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_bulk_body.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_bulk_body.ts
@@ -44,7 +44,10 @@ export const buildBulkBody = (
     ...additionalSignalFields(mergedDoc),
   };
   const event = buildEventTypeSignal(mergedDoc);
-  const { threshold_result: thresholdResult, ...filteredSource } = mergedDoc._source || {
+  // Filter out any kibana.* fields from the generated signal - kibana.* fields are aliases
+  // in siem-signals so we can't write to them, but for signals-on-signals they'll be returned
+  // in the fields API response and merged into the mergedDoc source
+  const { threshold_result: thresholdResult, kibana, ...filteredSource } = mergedDoc._source || {
     threshold_result: null,
   };
   const signalHit: SignalHit = {
@@ -145,9 +148,13 @@ export const buildSignalFromEvent = (
     ...additionalSignalFields(mergedEvent),
   };
   const eventFields = buildEventTypeSignal(mergedEvent);
+  // Filter out any kibana.* fields from the generated signal - kibana.* fields are aliases
+  // in siem-signals so we can't write to them, but for signals-on-signals they'll be returned
+  // in the fields API response and merged into the mergedDoc source
+  const { kibana, ...filteredSource } = mergedEvent._source || {};
   // TODO: better naming for SignalHit - it's really a new signal to be inserted
   const signalHit: SignalHit = {
-    ...mergedEvent._source,
+    ...filteredSource,
     '@timestamp': new Date().toISOString(),
     event: eventFields,
     signal,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filter_duplicate_signals.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filter_duplicate_signals.ts
index fb562a2d11f0a6..460cf6894a73cb 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filter_duplicate_signals.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filter_duplicate_signals.ts
@@ -8,37 +8,21 @@
 import { WrappedRACAlert } from '../rule_types/types';
 import { Ancestor, SimpleHit, WrappedSignalHit } from './types';
 
-const isWrappedSignalHit = (
-  signals: SimpleHit[],
-  isRuleRegistryEnabled: boolean
-): signals is WrappedSignalHit[] => {
-  return !isRuleRegistryEnabled;
-};
-
-const isWrappedRACAlert = (
-  signals: SimpleHit[],
-  isRuleRegistryEnabled: boolean
-): signals is WrappedRACAlert[] => {
-  return isRuleRegistryEnabled;
-};
-
 export const filterDuplicateSignals = (
   ruleId: string,
   signals: SimpleHit[],
   isRuleRegistryEnabled: boolean
 ) => {
-  if (isWrappedSignalHit(signals, isRuleRegistryEnabled)) {
-    return signals.filter(
+  if (!isRuleRegistryEnabled) {
+    return (signals as WrappedSignalHit[]).filter(
       (doc) => !doc._source.signal?.ancestors.some((ancestor) => ancestor.rule === ruleId)
     );
-  } else if (isWrappedRACAlert(signals, isRuleRegistryEnabled)) {
-    return signals.filter(
+  } else {
+    return (signals as WrappedRACAlert[]).filter(
       (doc) =>
         !(doc._source['kibana.alert.ancestors'] as Ancestor[]).some(
           (ancestor) => ancestor.rule === ruleId
         )
     );
-  } else {
-    return signals;
   }
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_input_output_index.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_input_output_index.test.ts
index 5058056b169a32..c8ef0093291d58 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_input_output_index.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_input_output_index.test.ts
@@ -34,6 +34,7 @@ describe('get_input_output_index', () => {
       index: ['test-input-index-1'],
       experimentalFeatures: {
         trustedAppsByPolicyEnabled: false,
+        excludePoliciesInFilterEnabled: false,
         metricsEntitiesEnabled: false,
         ruleRegistryEnabled: false,
         tGridEnabled: false,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_or_create_rule_statuses.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_or_create_rule_statuses.ts
index 8c4ffdb2a6c4a2..0390c073354a6e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_or_create_rule_statuses.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_or_create_rule_statuses.ts
@@ -8,47 +8,54 @@
 import { SavedObject } from 'src/core/server';
 
 import { IRuleStatusSOAttributes } from '../rules/types';
-import { RuleStatusSavedObjectsClient } from './rule_status_saved_objects_client';
-import { getRuleStatusSavedObjects } from './get_rule_status_saved_objects';
 import { RuleExecutionStatus } from '../../../../common/detection_engine/schemas/common/schemas';
+import { IRuleExecutionLogClient } from '../rule_execution_log/types';
+import { MAX_RULE_STATUSES } from './rule_status_service';
 
 interface RuleStatusParams {
   alertId: string;
-  ruleStatusClient: RuleStatusSavedObjectsClient;
+  spaceId: string;
+  ruleStatusClient: IRuleExecutionLogClient;
 }
 
 export const createNewRuleStatus = async ({
   alertId,
+  spaceId,
   ruleStatusClient,
 }: RuleStatusParams): Promise<SavedObject<IRuleStatusSOAttributes>> => {
   const now = new Date().toISOString();
   return ruleStatusClient.create({
-    alertId,
-    statusDate: now,
-    status: RuleExecutionStatus['going to run'],
-    lastFailureAt: null,
-    lastSuccessAt: null,
-    lastFailureMessage: null,
-    lastSuccessMessage: null,
-    gap: null,
-    bulkCreateTimeDurations: [],
-    searchAfterTimeDurations: [],
-    lastLookBackDate: null,
+    spaceId,
+    attributes: {
+      alertId,
+      statusDate: now,
+      status: RuleExecutionStatus['going to run'],
+      lastFailureAt: null,
+      lastSuccessAt: null,
+      lastFailureMessage: null,
+      lastSuccessMessage: null,
+      gap: null,
+      bulkCreateTimeDurations: [],
+      searchAfterTimeDurations: [],
+      lastLookBackDate: null,
+    },
   });
 };
 
 export const getOrCreateRuleStatuses = async ({
+  spaceId,
   alertId,
   ruleStatusClient,
 }: RuleStatusParams): Promise<Array<SavedObject<IRuleStatusSOAttributes>>> => {
-  const ruleStatuses = await getRuleStatusSavedObjects({
-    alertId,
-    ruleStatusClient,
+  const ruleStatuses = await ruleStatusClient.find({
+    spaceId,
+    ruleId: alertId,
+    logsCount: MAX_RULE_STATUSES,
   });
   if (ruleStatuses.length > 0) {
     return ruleStatuses;
   }
-  const newStatus = await createNewRuleStatus({ alertId, ruleStatusClient });
+  const newStatus = await createNewRuleStatus({ alertId, spaceId, ruleStatusClient });
 
   return [newStatus];
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_rule_status_saved_objects.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_rule_status_saved_objects.ts
deleted file mode 100644
index dd3a2826018e2c..00000000000000
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_rule_status_saved_objects.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { SavedObjectsFindResult } from 'kibana/server';
-import { IRuleStatusSOAttributes } from '../rules/types';
-import { MAX_RULE_STATUSES } from './rule_status_service';
-import { RuleStatusSavedObjectsClient } from './rule_status_saved_objects_client';
-
-interface GetRuleStatusSavedObject {
-  alertId: string;
-  ruleStatusClient: RuleStatusSavedObjectsClient;
-}
-
-export const getRuleStatusSavedObjects = async ({
-  alertId,
-  ruleStatusClient,
-}: GetRuleStatusSavedObject): Promise<Array<SavedObjectsFindResult<IRuleStatusSOAttributes>>> => {
-  return ruleStatusClient.find({
-    perPage: MAX_RULE_STATUSES,
-    sortField: 'statusDate',
-    sortOrder: 'desc',
-    search: `${alertId}`,
-    searchFields: ['alertId'],
-  });
-};
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_saved_objects_client.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_saved_objects_client.ts
index 62f02ad6a251ab..b7450091855248 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_saved_objects_client.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_saved_objects_client.ts
@@ -34,6 +34,9 @@ export interface FindBulkResponse {
   [key: string]: IRuleStatusSOAttributes[] | undefined;
 }
 
+/**
+ * @pdeprecated Use RuleExecutionLogClient instead
+ */
 export const ruleStatusSavedObjectsClientFactory = (
   savedObjectsClient: SavedObjectsClientContract
 ): RuleStatusSavedObjectsClient => ({
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.test.ts
index ec843351d74b50..9a36dd0103a606 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.test.ts
@@ -5,7 +5,6 @@
  * 2.0.
  */
 
-import { ruleStatusSavedObjectsClientMock } from './__mocks__/rule_status_saved_objects_client.mock';
 import {
   buildRuleStatusAttributes,
   RuleStatusService,
@@ -14,6 +13,8 @@ import {
 } from './rule_status_service';
 import { exampleRuleStatus, exampleFindRuleStatusResponse } from './__mocks__/es_results';
 import { RuleExecutionStatus } from '../../../../common/detection_engine/schemas/common/schemas';
+import { RuleExecutionLogClient } from '../rule_execution_log/__mocks__/rule_execution_log_client';
+import { UpdateExecutionLogArgs } from '../rule_execution_log/types';
 
 const expectIsoDateString = expect.stringMatching(/2.*Z$/);
 const buildStatuses = (n: number) =>
@@ -87,27 +88,32 @@ describe('buildRuleStatusAttributes', () => {
 
 describe('ruleStatusService', () => {
   let currentStatus: ReturnType<typeof exampleRuleStatus>;
-  let ruleStatusClient: ReturnType<typeof ruleStatusSavedObjectsClientMock.create>;
+  let ruleStatusClient: ReturnType<typeof RuleExecutionLogClient>;
   let service: RuleStatusService;
 
   beforeEach(async () => {
     currentStatus = exampleRuleStatus();
-    ruleStatusClient = ruleStatusSavedObjectsClientMock.create();
+    ruleStatusClient = new RuleExecutionLogClient();
     ruleStatusClient.find.mockResolvedValue(exampleFindRuleStatusResponse([currentStatus]));
-    service = await ruleStatusServiceFactory({ alertId: 'mock-alert-id', ruleStatusClient });
+    service = await ruleStatusServiceFactory({
+      alertId: 'mock-alert-id',
+      ruleStatusClient,
+      spaceId: 'default',
+    });
   });
 
   describe('goingToRun', () => {
     it('updates the current status to "going to run"', async () => {
       await service.goingToRun();
 
-      expect(ruleStatusClient.update).toHaveBeenCalledWith(
-        currentStatus.id,
-        expect.objectContaining({
+      expect(ruleStatusClient.update).toHaveBeenCalledWith<[UpdateExecutionLogArgs]>({
+        id: currentStatus.id,
+        spaceId: 'default',
+        attributes: expect.objectContaining({
           status: 'going to run',
           statusDate: expectIsoDateString,
-        })
-      );
+        }),
+      });
     });
   });
 
@@ -115,15 +121,16 @@ describe('ruleStatusService', () => {
     it('updates the current status to "succeeded"', async () => {
       await service.success('hey, it worked');
 
-      expect(ruleStatusClient.update).toHaveBeenCalledWith(
-        currentStatus.id,
-        expect.objectContaining({
+      expect(ruleStatusClient.update).toHaveBeenCalledWith<[UpdateExecutionLogArgs]>({
+        id: currentStatus.id,
+        spaceId: 'default',
+        attributes: expect.objectContaining({
           status: 'succeeded',
           statusDate: expectIsoDateString,
           lastSuccessAt: expectIsoDateString,
           lastSuccessMessage: 'hey, it worked',
-        })
-      );
+        }),
+      });
     });
   });
 
@@ -136,15 +143,16 @@ describe('ruleStatusService', () => {
     it('updates the current status to "failed"', async () => {
       await service.error('oh no, it broke');
 
-      expect(ruleStatusClient.update).toHaveBeenCalledWith(
-        currentStatus.id,
-        expect.objectContaining({
+      expect(ruleStatusClient.update).toHaveBeenCalledWith<[UpdateExecutionLogArgs]>({
+        id: currentStatus.id,
+        spaceId: 'default',
+        attributes: expect.objectContaining({
           status: 'failed',
           statusDate: expectIsoDateString,
           lastFailureAt: expectIsoDateString,
           lastFailureMessage: 'oh no, it broke',
-        })
-      );
+        }),
+      });
     });
 
     it('does not delete statuses if we have less than the max number of statuses', async () => {
@@ -158,7 +166,11 @@ describe('ruleStatusService', () => {
       ruleStatusClient.find.mockResolvedValue(
         exampleFindRuleStatusResponse(buildStatuses(MAX_RULE_STATUSES - 1))
       );
-      service = await ruleStatusServiceFactory({ alertId: 'mock-alert-id', ruleStatusClient });
+      service = await ruleStatusServiceFactory({
+        alertId: 'mock-alert-id',
+        ruleStatusClient,
+        spaceId: 'default',
+      });
 
       await service.error('oh no, it broke');
 
@@ -170,7 +182,11 @@ describe('ruleStatusService', () => {
       ruleStatusClient.find.mockResolvedValue(
         exampleFindRuleStatusResponse(buildStatuses(MAX_RULE_STATUSES))
       );
-      service = await ruleStatusServiceFactory({ alertId: 'mock-alert-id', ruleStatusClient });
+      service = await ruleStatusServiceFactory({
+        alertId: 'mock-alert-id',
+        ruleStatusClient,
+        spaceId: 'default',
+      });
 
       await service.error('oh no, it broke');
 
@@ -184,7 +200,11 @@ describe('ruleStatusService', () => {
       ruleStatusClient.find.mockResolvedValue(
         exampleFindRuleStatusResponse(buildStatuses(MAX_RULE_STATUSES + 1))
       );
-      service = await ruleStatusServiceFactory({ alertId: 'mock-alert-id', ruleStatusClient });
+      service = await ruleStatusServiceFactory({
+        alertId: 'mock-alert-id',
+        ruleStatusClient,
+        spaceId: 'default',
+      });
 
       await service.error('oh no, it broke');
 
@@ -200,7 +220,11 @@ describe('ruleStatusService', () => {
       ruleStatusClient.find.mockResolvedValue(
         exampleFindRuleStatusResponse(buildStatuses(MAX_RULE_STATUSES))
       );
-      service = await ruleStatusServiceFactory({ alertId: 'mock-alert-id', ruleStatusClient });
+      service = await ruleStatusServiceFactory({
+        alertId: 'mock-alert-id',
+        ruleStatusClient,
+        spaceId: 'default',
+      });
 
       await service.error('oh no, it broke');
       await service.error('oh no, it broke');
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.ts
index 0d51a6663b709e..45eff57d304e64 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/rule_status_service.ts
@@ -9,7 +9,7 @@ import { assertUnreachable } from '../../../../common/utility_types';
 import { RuleExecutionStatus } from '../../../../common/detection_engine/schemas/common/schemas';
 import { IRuleStatusSOAttributes } from '../rules/types';
 import { getOrCreateRuleStatuses } from './get_or_create_rule_statuses';
-import { RuleStatusSavedObjectsClient } from './rule_status_saved_objects_client';
+import { IRuleExecutionLogClient } from '../rule_execution_log/types';
 
 // 1st is mutable status, followed by 5 most recent failures
 export const MAX_RULE_STATUSES = 6;
@@ -78,51 +78,69 @@ export const buildRuleStatusAttributes: (
 };
 
 export const ruleStatusServiceFactory = async ({
+  spaceId,
   alertId,
   ruleStatusClient,
 }: {
+  spaceId: string;
   alertId: string;
-  ruleStatusClient: RuleStatusSavedObjectsClient;
+  ruleStatusClient: IRuleExecutionLogClient;
 }): Promise<RuleStatusService> => {
   return {
     goingToRun: async () => {
       const [currentStatus] = await getOrCreateRuleStatuses({
+        spaceId,
         alertId,
         ruleStatusClient,
       });
 
-      await ruleStatusClient.update(currentStatus.id, {
-        ...currentStatus.attributes,
-        ...buildRuleStatusAttributes(RuleExecutionStatus['going to run']),
+      await ruleStatusClient.update({
+        id: currentStatus.id,
+        attributes: {
+          ...currentStatus.attributes,
+          ...buildRuleStatusAttributes(RuleExecutionStatus['going to run']),
+        },
+        spaceId,
       });
     },
 
     success: async (message, attributes) => {
       const [currentStatus] = await getOrCreateRuleStatuses({
+        spaceId,
         alertId,
         ruleStatusClient,
       });
 
-      await ruleStatusClient.update(currentStatus.id, {
-        ...currentStatus.attributes,
-        ...buildRuleStatusAttributes(RuleExecutionStatus.succeeded, message, attributes),
+      await ruleStatusClient.update({
+        id: currentStatus.id,
+        attributes: {
+          ...currentStatus.attributes,
+          ...buildRuleStatusAttributes(RuleExecutionStatus.succeeded, message, attributes),
+        },
+        spaceId,
       });
     },
 
     partialFailure: async (message, attributes) => {
       const [currentStatus] = await getOrCreateRuleStatuses({
+        spaceId,
         alertId,
         ruleStatusClient,
       });
 
-      await ruleStatusClient.update(currentStatus.id, {
-        ...currentStatus.attributes,
-        ...buildRuleStatusAttributes(RuleExecutionStatus['partial failure'], message, attributes),
+      await ruleStatusClient.update({
+        id: currentStatus.id,
+        attributes: {
+          ...currentStatus.attributes,
+          ...buildRuleStatusAttributes(RuleExecutionStatus['partial failure'], message, attributes),
+        },
+        spaceId,
       });
     },
 
     error: async (message, attributes) => {
       const ruleStatuses = await getOrCreateRuleStatuses({
+        spaceId,
         alertId,
         ruleStatusClient,
       });
@@ -134,8 +152,12 @@ export const ruleStatusServiceFactory = async ({
       };
 
       // We always update the newest status, so to 'persist' a failure we push a copy to the head of the list
-      await ruleStatusClient.update(currentStatus.id, failureAttributes);
-      const newStatus = await ruleStatusClient.create(failureAttributes);
+      await ruleStatusClient.update({
+        id: currentStatus.id,
+        attributes: failureAttributes,
+        spaceId,
+      });
+      const newStatus = await ruleStatusClient.create({ attributes: failureAttributes, spaceId });
 
       // drop oldest failures
       const oldStatuses = [newStatus, ...ruleStatuses].slice(MAX_RULE_STATUSES);
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.test.ts
index a14c678d275361..6435204d1b7dfd 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.test.ts
@@ -34,6 +34,7 @@ import { mlExecutor } from './executors/ml';
 import { getMlRuleParams, getQueryRuleParams } from '../schemas/rule_schemas.mock';
 import { ResponseError } from '@elastic/elasticsearch/lib/errors';
 import { allowedExperimentalValues } from '../../../../common/experimental_features';
+import { ruleRegistryMocks } from '../../../../../rule_registry/server/mocks';
 
 jest.mock('./rule_status_saved_objects_client');
 jest.mock('./rule_status_service');
@@ -119,6 +120,7 @@ describe('signal_rule_alert_type', () => {
   let logger: ReturnType<typeof loggingSystemMock.createLogger>;
   let alertServices: AlertServicesMock;
   let ruleStatusService: Record<string, jest.Mock>;
+  let ruleDataService: ReturnType<typeof ruleRegistryMocks.createRuleDataPluginService>;
 
   beforeEach(() => {
     alertServices = alertsMock.createAlertServices();
@@ -130,6 +132,7 @@ describe('signal_rule_alert_type', () => {
       error: jest.fn(),
       partialFailure: jest.fn(),
     };
+    ruleDataService = ruleRegistryMocks.createRuleDataPluginService();
     (ruleStatusServiceFactory as jest.Mock).mockReturnValue(ruleStatusService);
     (getListsClient as jest.Mock).mockReturnValue({
       listClient: getListClientMock(),
@@ -196,6 +199,7 @@ describe('signal_rule_alert_type', () => {
       ml: mlMock,
       lists: listMock.createSetup(),
       mergeStrategy: 'missingFields',
+      ruleDataService,
     });
   });
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
index d1cb7194f86eed..7e467891e6d4d4 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
@@ -47,7 +47,6 @@ import {
 } from '../notifications/schedule_notification_actions';
 import { ruleStatusServiceFactory } from './rule_status_service';
 import { buildRuleMessageFactory } from './rule_messages';
-import { ruleStatusSavedObjectsClientFactory } from './rule_status_saved_objects_client';
 import { getNotificationResultsLink } from '../notifications/utils';
 import { TelemetryEventsSender } from '../../telemetry/sender';
 import { eqlExecutor } from './executors/eql';
@@ -70,6 +69,8 @@ import { wrapHitsFactory } from './wrap_hits_factory';
 import { wrapSequencesFactory } from './wrap_sequences_factory';
 import { ConfigType } from '../../../config';
 import { ExperimentalFeatures } from '../../../../common/experimental_features';
+import { RuleExecutionLogClient } from '../rule_execution_log/rule_execution_log_client';
+import { IRuleDataPluginService } from '../rule_execution_log/types';
 
 export const signalRulesAlertType = ({
   logger,
@@ -79,6 +80,7 @@ export const signalRulesAlertType = ({
   ml,
   lists,
   mergeStrategy,
+  ruleDataService,
 }: {
   logger: Logger;
   eventsTelemetry: TelemetryEventsSender | undefined;
@@ -87,6 +89,7 @@ export const signalRulesAlertType = ({
   ml: SetupPlugins['ml'];
   lists: SetupPlugins['lists'] | undefined;
   mergeStrategy: ConfigType['alertMergeStrategy'];
+  ruleDataService: IRuleDataPluginService;
 }): SignalRuleAlertTypeDefinition => {
   return {
     id: SIGNALS_ID,
@@ -124,8 +127,12 @@ export const signalRulesAlertType = ({
       const searchAfterSize = Math.min(maxSignals, DEFAULT_SEARCH_AFTER_PAGE_SIZE);
       let hasError: boolean = false;
       let result = createSearchAfterReturnType();
-      const ruleStatusClient = ruleStatusSavedObjectsClientFactory(services.savedObjectsClient);
+      const ruleStatusClient = new RuleExecutionLogClient({
+        ruleDataService,
+        savedObjectsClient: services.savedObjectsClient,
+      });
       const ruleStatusService = await ruleStatusServiceFactory({
+        spaceId,
         alertId,
         ruleStatusClient,
       });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/types.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/types.ts
index 4ad734c3bf7d96..6cbe0d1a527047 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/types.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/types.ts
@@ -33,6 +33,8 @@ import { BuildRuleMessage } from './rule_messages';
 import { TelemetryEventsSender } from '../../telemetry/sender';
 import { RuleParams } from '../schemas/rule_schemas';
 import { GenericBulkCreateResponse } from './bulk_create_factory';
+import { EcsFieldMap } from '../../../../../rule_registry/common/assets/field_maps/ecs_field_map';
+import { TypeOfFieldMap } from '../../../../../rule_registry/common/field_map';
 
 // used for gap detection code
 // eslint-disable-next-line @typescript-eslint/naming-convention
@@ -119,6 +121,7 @@ export interface SignalSource {
     original_time?: string;
     threshold_result?: ThresholdResult;
   };
+  kibana?: SearchTypes;
 }
 
 export interface BulkItem {
@@ -166,6 +169,12 @@ export interface GetResponse {
   _source: SearchTypes;
 }
 
+export type EventHit = Exclude<TypeOfFieldMap<EcsFieldMap>, '@timestamp'> & {
+  '@timestamp': string;
+  [key: string]: SearchTypes;
+};
+export type WrappedEventHit = BaseHit<EventHit>;
+
 export type SignalSearchResponse = estypes.SearchResponse<SignalSource>;
 export type SignalSourceHit = estypes.SearchHit<SignalSource>;
 export type WrappedSignalHit = BaseHit<SignalHit>;
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.ts
index cb1bf9d774359a..72ac4f6d0f550c 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/utils.ts
@@ -5,18 +5,20 @@
  * 2.0.
  */
 import { createHash } from 'crypto';
+import { chunk, get, isEmpty, partition } from 'lodash';
 import moment from 'moment';
 import uuidv5 from 'uuid/v5';
+
 import dateMath from '@elastic/datemath';
 import type { estypes } from '@elastic/elasticsearch';
-import { chunk, isEmpty, partition } from 'lodash';
 import { ApiResponse, Context } from '@elastic/elasticsearch/lib/Transport';
-
+import { ALERT_ID } from '@kbn/rule-data-utils';
 import type { ListArray, ExceptionListItemSchema } from '@kbn/securitysolution-io-ts-list-types';
 import { MAX_EXCEPTION_LIST_SIZE } from '@kbn/securitysolution-list-constants';
 import { hasLargeValueList } from '@kbn/securitysolution-list-utils';
 import { parseScheduleDates } from '@kbn/securitysolution-io-ts-utils';
 import { ElasticsearchClient } from '@kbn/securitysolution-es-utils';
+
 import {
   TimestampOverrideOrUndefined,
   Privilege,
@@ -39,6 +41,8 @@ import {
   RuleRangeTuple,
   BaseSignalHit,
   SignalSourceHit,
+  SimpleHit,
+  WrappedEventHit,
 } from './types';
 import { BuildRuleMessage } from './rule_messages';
 import { ShardError } from '../../types';
@@ -52,6 +56,8 @@ import {
   ThreatRuleParams,
   ThresholdRuleParams,
 } from '../schemas/rule_schemas';
+import { WrappedRACAlert } from '../rule_types/types';
+import { SearchTypes } from '../../../../common/detection_engine/types';
 
 interface SortExceptionsReturn {
   exceptionsWithValueLists: ExceptionListItemSchema[];
@@ -928,3 +934,25 @@ export const buildChunkedOrFilter = (field: string, values: string[], chunkSize:
     })
     .join(' OR ');
 };
+
+export const isWrappedEventHit = (event: SimpleHit): event is WrappedEventHit => {
+  return !isWrappedSignalHit(event) && !isWrappedRACAlert(event);
+};
+
+export const isWrappedSignalHit = (event: SimpleHit): event is WrappedSignalHit => {
+  return (event as WrappedSignalHit)?._source?.signal != null;
+};
+
+export const isWrappedRACAlert = (event: SimpleHit): event is WrappedRACAlert => {
+  return (event as WrappedRACAlert)?._source?.[ALERT_ID] != null;
+};
+
+export const getField = <T extends SearchTypes>(event: SimpleHit, field: string): T | undefined => {
+  if (isWrappedRACAlert(event)) {
+    return event._source, field.replace('signal', 'kibana.alert') as T; // TODO: handle special cases
+  } else if (isWrappedSignalHit(event)) {
+    return get(event._source, field) as T;
+  } else if (isWrappedEventHit(event)) {
+    return get(event._source, field) as T;
+  }
+};
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index 96171154f60071..e67c9fbfd8327d 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -8,6 +8,7 @@
 import { once } from 'lodash';
 import { Observable } from 'rxjs';
 import LRU from 'lru-cache';
+import { estypes } from '@elastic/elasticsearch';
 
 import {
   CoreSetup,
@@ -87,6 +88,7 @@ import { licenseService } from './lib/license';
 import { PolicyWatcher } from './endpoint/lib/policy/license_watch';
 import { parseExperimentalConfigValue } from '../common/experimental_features';
 import { migrateArtifactsToFleet } from './endpoint/lib/artifacts/migrate_artifacts_to_fleet';
+import aadFieldConversion from './lib/detection_engine/routes/index/signal_aad_mapping.json';
 import { alertsFieldMap } from './lib/detection_engine/rule_types/field_maps/alerts';
 import { rulesFieldMap } from './lib/detection_engine/rule_types/field_maps/rules';
 import { RuleExecutionLogClient } from './lib/detection_engine/rule_execution_log/rule_execution_log_client';
@@ -187,7 +189,6 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
         getExecutionLogClient: () =>
           new RuleExecutionLogClient({
             ruleDataService: plugins.ruleRegistry.ruleDataService,
-            // TODO check if savedObjects.client contains spaceId
             savedObjectsClient: context.core.savedObjects.client,
           }),
       })
@@ -202,17 +203,27 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
     const isRuleRegistryEnabled = experimentalFeatures.ruleRegistryEnabled;
 
     let ruleDataClient: RuleDataClient | null = null;
+    const { ruleDataService } = plugins.ruleRegistry;
     if (isRuleRegistryEnabled) {
-      const { ruleDataService } = plugins.ruleRegistry;
-
       const alertsIndexPattern = ruleDataService.getFullAssetName('security.alerts*');
 
       const initializeRuleDataTemplates = once(async () => {
         if (!ruleDataService.isWriteEnabled()) {
           return;
         }
-        const componentTemplateName = ruleDataService.getFullAssetName('security.alerts-mappings');
 
+        // TODO: convert the aliases to FieldMaps. Requires enhancing FieldMap to support alias path.
+        // Split aliases by component template since we need to alias some fields in technical field mappings,
+        // some fields in security solution specific component template.
+        const aliases: Record<string, estypes.MappingProperty> = {};
+        Object.entries(aadFieldConversion).forEach(([key, value]) => {
+          aliases[key] = {
+            type: 'alias',
+            path: value,
+          };
+        });
+
+        const componentTemplateName = ruleDataService.getFullAssetName('security.alerts-mappings');
         await ruleDataService.createOrUpdateComponentTemplate({
           name: componentTemplateName,
           body: {
@@ -262,6 +273,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
           mergeStrategy: this.config.alertMergeStrategy,
           ruleDataClient,
           version: this.context.env.packageInfo.version,
+          ruleDataService,
         })
       );
     }
@@ -273,6 +285,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       plugins.encryptedSavedObjects?.canEncrypt === true,
       plugins.security,
       plugins.ml,
+      ruleDataService,
       ruleDataClient
     );
     registerEndpointRoutes(router, endpointContext);
@@ -303,6 +316,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
         lists: plugins.lists,
         mergeStrategy: this.config.alertMergeStrategy,
         experimentalFeatures,
+        ruleDataService: plugins.ruleRegistry.ruleDataService,
       });
       const ruleNotificationType = rulesNotificationAlertType({
         logger: this.logger,
diff --git a/x-pack/plugins/security_solution/server/routes/index.ts b/x-pack/plugins/security_solution/server/routes/index.ts
index 00de66c0dec284..c029e421ab81ea 100644
--- a/x-pack/plugins/security_solution/server/routes/index.ts
+++ b/x-pack/plugins/security_solution/server/routes/index.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { RuleDataClient } from '../../../rule_registry/server';
+import { RuleDataClient, RuleDataPluginService } from '../../../rule_registry/server';
 
 import { SecuritySolutionPluginRouter } from '../types';
 
@@ -63,6 +63,7 @@ export const initRoutes = (
   hasEncryptionKey: boolean,
   security: SetupPlugins['security'],
   ml: SetupPlugins['ml'],
+  ruleDataService: RuleDataPluginService,
   ruleDataClient: RuleDataClient | null
 ) => {
   // Detection Engine Rule routes that have the REST endpoints of /api/detection_engine/rules
@@ -117,7 +118,7 @@ export const initRoutes = (
 
   // Detection Engine index routes that have the REST endpoints of /api/detection_engine/index
   // All REST index creation, policy management for spaces
-  createIndexRoute(router);
+  createIndexRoute(router, ruleDataService, config);
   readIndexRoute(router, config);
   deleteIndexRoute(router);
 
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/index.test.tsx b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/index.test.tsx
index 60602d75602bf4..e921e8420eb96d 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/index.test.tsx
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/index.test.tsx
@@ -31,6 +31,7 @@ const mockDeps = {
     config: jest.fn().mockResolvedValue({}),
     experimentalFeatures: {
       trustedAppsByPolicyEnabled: false,
+      excludePoliciesInFilterEnabled: false,
       metricsEntitiesEnabled: false,
       ruleRegistryEnabled: false,
       tGridEnabled: false,
diff --git a/x-pack/plugins/stack_alerts/public/alert_types/threshold/visualization.tsx b/x-pack/plugins/stack_alerts/public/alert_types/threshold/visualization.tsx
index d959bf19c7cd8f..1db09d0492e68c 100644
--- a/x-pack/plugins/stack_alerts/public/alert_types/threshold/visualization.tsx
+++ b/x-pack/plugins/stack_alerts/public/alert_types/threshold/visualization.tsx
@@ -30,7 +30,7 @@ import {
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { ChartsPluginSetup } from 'src/plugins/charts/public';
-import { FieldFormatsStart } from 'src/plugins/data/public';
+import { FieldFormatsStart } from 'src/plugins/field_formats/public';
 import { useKibana } from '../../../../../../src/plugins/kibana_react/public';
 import {
   getThresholdAlertVisualizationData,
diff --git a/x-pack/plugins/timelines/common/search_strategy/timeline/events/index.ts b/x-pack/plugins/timelines/common/search_strategy/timeline/events/index.ts
index 82e439b386d606..6b204224d3d5de 100644
--- a/x-pack/plugins/timelines/common/search_strategy/timeline/events/index.ts
+++ b/x-pack/plugins/timelines/common/search_strategy/timeline/events/index.ts
@@ -17,7 +17,8 @@ export enum TimelineEventsQueries {
   lastEventTime = 'eventsLastEventTime',
 }
 
-export enum EntityType {
-  ALERTS = 'alerts',
-  EVENTS = 'events',
-}
+export const EntityType = {
+  ALERTS: 'alerts',
+  EVENTS: 'events',
+} as const;
+export type EntityType = typeof EntityType[keyof typeof EntityType];
diff --git a/x-pack/plugins/timelines/common/search_strategy/timeline/index.ts b/x-pack/plugins/timelines/common/search_strategy/timeline/index.ts
index cb5e27ec84d47d..99ee021cb68003 100644
--- a/x-pack/plugins/timelines/common/search_strategy/timeline/index.ts
+++ b/x-pack/plugins/timelines/common/search_strategy/timeline/index.ts
@@ -4,7 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import type { ALERTS_CONSUMERS } from '@kbn/rule-data-utils/target/alerts_as_data_rbac';
+import type { AlertConsumers } from '@kbn/rule-data-utils/target/alerts_as_data_rbac';
 
 import { IEsSearchRequest } from '../../../../../../src/plugins/data/common';
 import { ESQuery } from '../../typed_json';
@@ -44,7 +44,7 @@ export interface TimelineRequestBasicOptions extends IEsSearchRequest {
   docValueFields?: DocValueFields[];
   factoryQueryType?: TimelineFactoryQueryTypes;
   entityType?: EntityType;
-  alertConsumers?: ALERTS_CONSUMERS[];
+  alertConsumers?: AlertConsumers[];
 }
 
 export interface TimelineRequestSortField<Field = string> extends SortField<Field> {
diff --git a/x-pack/plugins/timelines/common/types/timeline/columns/index.ts b/x-pack/plugins/timelines/common/types/timeline/columns/index.tsx
similarity index 52%
rename from x-pack/plugins/timelines/common/types/timeline/columns/index.ts
rename to x-pack/plugins/timelines/common/types/timeline/columns/index.tsx
index 693cc1d842ee41..7f336557dad261 100644
--- a/x-pack/plugins/timelines/common/types/timeline/columns/index.ts
+++ b/x-pack/plugins/timelines/common/types/timeline/columns/index.tsx
@@ -5,8 +5,11 @@
  * 2.0.
  */
 
-import { EuiDataGridColumn } from '@elastic/eui';
+import { ReactNode } from 'react';
+
+import { EuiDataGridColumn, EuiDataGridColumnCellActionProps } from '@elastic/eui';
 import { IFieldSubType } from '../../../../../../../src/plugins/data/common';
+import { BrowserFields } from '../../../search_strategy/index_fields';
 import { TimelineNonEcsData } from '../../../search_strategy/timeline';
 
 export type ColumnHeaderType = 'not-filtered' | 'text-filter';
@@ -14,6 +17,40 @@ export type ColumnHeaderType = 'not-filtered' | 'text-filter';
 /** Uniquely identifies a column */
 export type ColumnId = string;
 
+/**
+ * A `TGridCellAction` function accepts `data`, where each row of data is
+ * represented as a `TimelineNonEcsData[]`. For example, `data[0]` would
+ * contain a `TimelineNonEcsData[]` with the first row of data.
+ *
+ * A `TGridCellAction` returns a function that has access to all the
+ * `EuiDataGridColumnCellActionProps`, _plus_ access to `data`,
+ *  which enables code like the following example to be written:
+ *
+ * Example:
+ * ```
+ * ({ data }: { data: TimelineNonEcsData[][] }) => ({ rowIndex, columnId, Component }) => {
+ *   const value = getMappedNonEcsValue({
+ *     data: data[rowIndex], // access a specific row's values
+ *     fieldName: columnId,
+ *   });
+ *
+ *   return (
+ *     <Component onClick={() => alert(`row ${rowIndex} col ${columnId} has value ${value}`)} iconType="heart">
+ *       {'Love it'}
+ *      </Component>
+ *   );
+ * };
+ * ```
+ */
+export type TGridCellAction = ({
+  browserFields,
+  data,
+}: {
+  browserFields: BrowserFields;
+  /** each row of data is represented as one TimelineNonEcsData[] */
+  data: TimelineNonEcsData[][];
+}) => (props: EuiDataGridColumnCellActionProps) => ReactNode;
+
 /** The specification of a column header */
 export type ColumnHeaderOptions = Pick<
   EuiDataGridColumn,
@@ -26,6 +63,7 @@ export type ColumnHeaderOptions = Pick<
   | 'isSortable'
 > & {
   aggregatable?: boolean;
+  tGridCellActions?: TGridCellAction[];
   category?: string;
   columnHeaderType: ColumnHeaderType;
   description?: string;
diff --git a/x-pack/plugins/timelines/public/components/clipboard/translations.ts b/x-pack/plugins/timelines/public/components/clipboard/translations.ts
index a92c9656f3cf83..25b5ea7bf7b83d 100644
--- a/x-pack/plugins/timelines/public/components/clipboard/translations.ts
+++ b/x-pack/plugins/timelines/public/components/clipboard/translations.ts
@@ -25,3 +25,9 @@ export const COPY_TO_THE_CLIPBOARD = i18n.translate(
     defaultMessage: 'Copy to the clipboard',
   }
 );
+
+export const SUCCESS_TOAST_TITLE = (field: string) =>
+  i18n.translate('xpack.timelines.clipboard.copy.successToastTitle', {
+    values: { field },
+    defaultMessage: 'Copied field {field} to the clipboard',
+  });
diff --git a/x-pack/plugins/timelines/public/components/hover_actions/actions/add_to_timeline.tsx b/x-pack/plugins/timelines/public/components/hover_actions/actions/add_to_timeline.tsx
index dd5ef27c32a89c..80d413a29e6fca 100644
--- a/x-pack/plugins/timelines/public/components/hover_actions/actions/add_to_timeline.tsx
+++ b/x-pack/plugins/timelines/public/components/hover_actions/actions/add_to_timeline.tsx
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
-import React, { useCallback, useEffect } from 'react';
-import { EuiButtonIcon, EuiToolTip } from '@elastic/eui';
+import React, { useCallback, useEffect, useMemo } from 'react';
+import { EuiButtonEmpty, EuiButtonIcon, EuiToolTip } from '@elastic/eui';
 import { DraggableId } from 'react-beautiful-dnd';
 import { useDispatch } from 'react-redux';
 
@@ -44,12 +44,15 @@ const useGetHandleStartDragToTimeline = ({
 };
 
 export interface AddToTimelineButtonProps extends HoverActionComponentProps {
+  /** `Component` is only used with `EuiDataGrid`; the grid keeps a reference to `Component` for show / hide functionality */
+  Component?: typeof EuiButtonEmpty | typeof EuiButtonIcon;
   draggableId?: DraggableId;
   dataProvider?: DataProvider[] | DataProvider;
 }
 
 const AddToTimelineButton: React.FC<AddToTimelineButtonProps> = React.memo(
   ({
+    Component,
     closePopOver,
     dataProvider,
     defaultFocusedButtonRef,
@@ -96,6 +99,33 @@ const AddToTimelineButton: React.FC<AddToTimelineButtonProps> = React.memo(
       }
     }, [handleStartDragToTimeline, keyboardEvent, ownFocus]);
 
+    const button = useMemo(
+      () =>
+        Component ? (
+          <Component
+            aria-label={i18n.ADD_TO_TIMELINE}
+            buttonRef={defaultFocusedButtonRef}
+            data-test-subj="add-to-timeline"
+            iconType="timeline"
+            onClick={handleStartDragToTimeline}
+            title={i18n.ADD_TO_TIMELINE}
+          >
+            {i18n.ADD_TO_TIMELINE}
+          </Component>
+        ) : (
+          <EuiButtonIcon
+            aria-label={i18n.ADD_TO_TIMELINE}
+            buttonRef={defaultFocusedButtonRef}
+            className="timelines__hoverActionButton"
+            data-test-subj="add-to-timeline"
+            iconSize="s"
+            iconType="timeline"
+            onClick={handleStartDragToTimeline}
+          />
+        ),
+      [Component, defaultFocusedButtonRef, handleStartDragToTimeline]
+    );
+
     return showTooltip ? (
       <EuiToolTip
         content={
@@ -110,26 +140,10 @@ const AddToTimelineButton: React.FC<AddToTimelineButtonProps> = React.memo(
           />
         }
       >
-        <EuiButtonIcon
-          aria-label={i18n.ADD_TO_TIMELINE}
-          buttonRef={defaultFocusedButtonRef}
-          className="timelines__hoverActionButton"
-          data-test-subj="add-to-timeline"
-          iconSize="s"
-          iconType="timeline"
-          onClick={handleStartDragToTimeline}
-        />
+        {button}
       </EuiToolTip>
     ) : (
-      <EuiButtonIcon
-        aria-label={i18n.ADD_TO_TIMELINE}
-        buttonRef={defaultFocusedButtonRef}
-        className="timelines__hoverActionButton"
-        data-test-subj="add-to-timeline"
-        iconSize="s"
-        iconType="timeline"
-        onClick={handleStartDragToTimeline}
-      />
+      button
     );
   }
 );
diff --git a/x-pack/plugins/timelines/public/components/hover_actions/actions/copy.tsx b/x-pack/plugins/timelines/public/components/hover_actions/actions/copy.tsx
index 1b567dee50683e..c188af67d33fde 100644
--- a/x-pack/plugins/timelines/public/components/hover_actions/actions/copy.tsx
+++ b/x-pack/plugins/timelines/public/components/hover_actions/actions/copy.tsx
@@ -5,12 +5,18 @@
  * 2.0.
  */
 
-import React, { useEffect, useRef } from 'react';
+import { EuiButtonEmpty, EuiButtonIcon } from '@elastic/eui';
+import copy from 'copy-to-clipboard';
+import React, { useCallback, useEffect, useMemo, useRef } from 'react';
 import { i18n } from '@kbn/i18n';
+
 import { stopPropagationAndPreventDefault } from '../../../../common';
 import { WithCopyToClipboard } from '../../clipboard/with_copy_to_clipboard';
 import { HoverActionComponentProps } from './types';
 import { COPY_TO_CLIPBOARD_BUTTON_CLASS_NAME } from '../../clipboard';
+import { useAppToasts } from '../../../hooks/use_app_toasts';
+import { COPY_TO_CLIPBOARD } from '../../t_grid/body/translations';
+import { SUCCESS_TOAST_TITLE } from '../../clipboard/translations';
 
 export const FIELD = i18n.translate('xpack.timelines.hoverActions.fieldLabel', {
   defaultMessage: 'Field',
@@ -19,11 +25,14 @@ export const FIELD = i18n.translate('xpack.timelines.hoverActions.fieldLabel', {
 export const COPY_TO_CLIPBOARD_KEYBOARD_SHORTCUT = 'c';
 
 export interface CopyProps extends HoverActionComponentProps {
+  /** `Component` is only used with `EuiDataGrid`; the grid keeps a reference to `Component` for show / hide functionality */
+  Component?: typeof EuiButtonEmpty | typeof EuiButtonIcon;
   isHoverAction?: boolean;
 }
 
 const CopyButton: React.FC<CopyProps> = React.memo(
-  ({ closePopOver, field, isHoverAction, keyboardEvent, ownFocus, value }) => {
+  ({ Component, closePopOver, field, isHoverAction, keyboardEvent, ownFocus, value }) => {
+    const { addSuccess } = useAppToasts();
     const panelRef = useRef<HTMLDivElement | null>(null);
     useEffect(() => {
       if (!ownFocus) {
@@ -42,13 +51,34 @@ const CopyButton: React.FC<CopyProps> = React.memo(
         }
       }
     }, [closePopOver, keyboardEvent, ownFocus]);
-    return (
+
+    const text = useMemo(() => `${field}${value != null ? `: "${value}"` : ''}`, [field, value]);
+
+    const onClick = useCallback(() => {
+      const isSuccess = copy(text, { debug: true });
+
+      if (isSuccess) {
+        addSuccess(SUCCESS_TOAST_TITLE(field), { toastLifeTimeMs: 800 });
+      }
+    }, [addSuccess, field, text]);
+
+    return Component ? (
+      <Component
+        aria-label={COPY_TO_CLIPBOARD}
+        data-test-subj="copy-to-clipboard"
+        iconType="copyClipboard"
+        onClick={onClick}
+        title={COPY_TO_CLIPBOARD}
+      >
+        {COPY_TO_CLIPBOARD}
+      </Component>
+    ) : (
       <div ref={panelRef}>
         <WithCopyToClipboard
           data-test-subj="copy-to-clipboard"
           isHoverAction={isHoverAction}
           keyboardShortcut={ownFocus ? COPY_TO_CLIPBOARD_KEYBOARD_SHORTCUT : ''}
-          text={`${field}${value != null ? `: "${value}"` : ''}`}
+          text={text}
           titleSummary={FIELD}
         />
       </div>
diff --git a/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_for_value.tsx b/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_for_value.tsx
index 58f7b4a831e513..6ba55f50560eba 100644
--- a/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_for_value.tsx
+++ b/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_for_value.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { useCallback, useEffect } from 'react';
+import React, { useCallback, useEffect, useMemo } from 'react';
 import { i18n } from '@kbn/i18n';
 import { EuiButtonIcon, EuiToolTip } from '@elastic/eui';
 
@@ -23,6 +23,7 @@ export type FilterForValueProps = HoverActionComponentProps & FilterValueFnArgs;
 
 const FilterForValueButton: React.FC<FilterForValueProps> = React.memo(
   ({
+    Component,
     closePopOver,
     defaultFocusedButtonRef,
     field,
@@ -63,6 +64,33 @@ const FilterForValueButton: React.FC<FilterForValueProps> = React.memo(
       }
     }, [filterForValueFn, keyboardEvent, ownFocus]);
 
+    const button = useMemo(
+      () =>
+        Component ? (
+          <Component
+            aria-label={FILTER_FOR_VALUE}
+            buttonRef={defaultFocusedButtonRef}
+            data-test-subj="filter-for-value"
+            iconType="plusInCircle"
+            onClick={filterForValueFn}
+            title={FILTER_FOR_VALUE}
+          >
+            {FILTER_FOR_VALUE}
+          </Component>
+        ) : (
+          <EuiButtonIcon
+            aria-label={FILTER_FOR_VALUE}
+            buttonRef={defaultFocusedButtonRef}
+            className="timelines__hoverActionButton"
+            data-test-subj="filter-for-value"
+            iconSize="s"
+            iconType="plusInCircle"
+            onClick={filterForValueFn}
+          />
+        ),
+      [Component, defaultFocusedButtonRef, filterForValueFn]
+    );
+
     return showTooltip ? (
       <EuiToolTip
         content={
@@ -77,26 +105,10 @@ const FilterForValueButton: React.FC<FilterForValueProps> = React.memo(
           />
         }
       >
-        <EuiButtonIcon
-          aria-label={FILTER_FOR_VALUE}
-          buttonRef={defaultFocusedButtonRef}
-          className="timelines__hoverActionButton"
-          data-test-subj="filter-for-value"
-          iconSize="s"
-          iconType="plusInCircle"
-          onClick={filterForValueFn}
-        />
+        {button}
       </EuiToolTip>
     ) : (
-      <EuiButtonIcon
-        aria-label={FILTER_FOR_VALUE}
-        buttonRef={defaultFocusedButtonRef}
-        className="timelines__hoverActionButton"
-        data-test-subj="filter-for-value"
-        iconSize="s"
-        iconType="plusInCircle"
-        onClick={filterForValueFn}
-      />
+      button
     );
   }
 );
diff --git a/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_out_value.tsx b/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_out_value.tsx
index 03150d6371397b..c19f4febf49d98 100644
--- a/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_out_value.tsx
+++ b/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_out_value.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { useCallback, useEffect } from 'react';
+import React, { useCallback, useEffect, useMemo } from 'react';
 import { i18n } from '@kbn/i18n';
 import { EuiButtonIcon, EuiToolTip } from '@elastic/eui';
 
@@ -22,6 +22,7 @@ export const FILTER_OUT_VALUE_KEYBOARD_SHORTCUT = 'o';
 
 const FilterOutValueButton: React.FC<HoverActionComponentProps & FilterValueFnArgs> = React.memo(
   ({
+    Component,
     closePopOver,
     defaultFocusedButtonRef,
     field,
@@ -64,6 +65,33 @@ const FilterOutValueButton: React.FC<HoverActionComponentProps & FilterValueFnAr
       }
     }, [filterOutValueFn, keyboardEvent, ownFocus]);
 
+    const button = useMemo(
+      () =>
+        Component ? (
+          <Component
+            aria-label={FILTER_OUT_VALUE}
+            buttonRef={defaultFocusedButtonRef}
+            data-test-subj="filter-out-value"
+            iconType="minusInCircle"
+            onClick={filterOutValueFn}
+            title={FILTER_OUT_VALUE}
+          >
+            {FILTER_OUT_VALUE}
+          </Component>
+        ) : (
+          <EuiButtonIcon
+            aria-label={FILTER_OUT_VALUE}
+            buttonRef={defaultFocusedButtonRef}
+            className="timelines__hoverActionButton"
+            data-test-subj="filter-out-value"
+            iconSize="s"
+            iconType="minusInCircle"
+            onClick={filterOutValueFn}
+          />
+        ),
+      [Component, defaultFocusedButtonRef, filterOutValueFn]
+    );
+
     return showTooltip ? (
       <EuiToolTip
         content={
@@ -78,26 +106,10 @@ const FilterOutValueButton: React.FC<HoverActionComponentProps & FilterValueFnAr
           />
         }
       >
-        <EuiButtonIcon
-          aria-label={FILTER_OUT_VALUE}
-          buttonRef={defaultFocusedButtonRef}
-          className="timelines__hoverActionButton"
-          data-test-subj="filter-out-value"
-          iconSize="s"
-          iconType="minusInCircle"
-          onClick={filterOutValueFn}
-        />
+        {button}
       </EuiToolTip>
     ) : (
-      <EuiButtonIcon
-        aria-label={FILTER_OUT_VALUE}
-        buttonRef={defaultFocusedButtonRef}
-        className="timelines__hoverActionButton"
-        data-test-subj="filter-out-value"
-        iconSize="s"
-        iconType="minusInCircle"
-        onClick={filterOutValueFn}
-      />
+      button
     );
   }
 );
diff --git a/x-pack/plugins/timelines/public/components/hover_actions/actions/types.ts b/x-pack/plugins/timelines/public/components/hover_actions/actions/types.ts
index fdef1403e3dc2f..06069ede15b985 100644
--- a/x-pack/plugins/timelines/public/components/hover_actions/actions/types.ts
+++ b/x-pack/plugins/timelines/public/components/hover_actions/actions/types.ts
@@ -5,10 +5,12 @@
  * 2.0.
  */
 
-import { EuiButtonIconPropsForButton } from '@elastic/eui';
+import { EuiButtonEmpty, EuiButtonIcon, EuiButtonIconPropsForButton } from '@elastic/eui';
 import { FilterManager } from '../../../../../../../src/plugins/data/public';
 
 export interface FilterValueFnArgs {
+  /** `Component` is only used with `EuiDataGrid`; the grid keeps a reference to `Component` for show / hide functionality */
+  Component?: typeof EuiButtonEmpty | typeof EuiButtonIcon;
   field: string;
   value: string[] | string | null | undefined;
   filterManager: FilterManager | undefined;
diff --git a/x-pack/plugins/timelines/public/components/t_grid/body/index.tsx b/x-pack/plugins/timelines/public/components/t_grid/body/index.tsx
index c9390dcf1985a8..00f9d513a1a165 100644
--- a/x-pack/plugins/timelines/public/components/t_grid/body/index.tsx
+++ b/x-pack/plugins/timelines/public/components/t_grid/body/index.tsx
@@ -7,6 +7,7 @@
 
 import {
   EuiDataGrid,
+  EuiDataGridColumn,
   EuiDataGridCellValueElementProps,
   EuiDataGridControlColumn,
   EuiDataGridStyle,
@@ -27,6 +28,7 @@ import React, {
 import { connect, ConnectedProps, useDispatch } from 'react-redux';
 
 import {
+  TGridCellAction,
   TimelineId,
   TimelineTabs,
   BulkActionsProp,
@@ -66,6 +68,7 @@ interface OwnProps {
   additionalControls?: React.ReactNode;
   browserFields: BrowserFields;
   data: TimelineItem[];
+  defaultCellActions?: TGridCellAction[];
   id: string;
   isEventViewer?: boolean;
   renderCellValue: (props: CellValueElementProps) => React.ReactNode;
@@ -211,6 +214,7 @@ export const BodyComponent = React.memo<StatefulBodyProps>(
     browserFields,
     columnHeaders,
     data,
+    defaultCellActions,
     excludedRowRendererIds,
     id,
     isEventViewer = false,
@@ -461,6 +465,24 @@ export const BodyComponent = React.memo<StatefulBodyProps>(
       sort,
     ]);
 
+    const columnsWithCellActions: EuiDataGridColumn[] = useMemo(
+      () =>
+        columnHeaders.map((header) => {
+          const buildAction = (tGridCellAction: TGridCellAction) =>
+            tGridCellAction({
+              data: data.map((row) => row.data),
+              browserFields,
+            });
+
+          return {
+            ...header,
+            cellActions:
+              header.tGridCellActions?.map(buildAction) ?? defaultCellActions?.map(buildAction),
+          };
+        }),
+      [browserFields, columnHeaders, data, defaultCellActions]
+    );
+
     const renderTGridCellValue: (x: EuiDataGridCellValueElementProps) => React.ReactNode = ({
       columnId,
       rowIndex,
@@ -494,7 +516,7 @@ export const BodyComponent = React.memo<StatefulBodyProps>(
       <EuiDataGrid
         data-test-subj="body-data-grid"
         aria-label={i18n.TGRID_BODY_ARIA_LABEL}
-        columns={columnHeaders}
+        columns={columnsWithCellActions}
         columnVisibility={{ visibleColumns, setVisibleColumns }}
         gridStyle={gridStyle}
         leadingControlColumns={leadingTGridControlColumns}
diff --git a/x-pack/plugins/timelines/public/components/t_grid/integrated/index.tsx b/x-pack/plugins/timelines/public/components/t_grid/integrated/index.tsx
index 2b3de6ac78fe53..ef140924d43473 100644
--- a/x-pack/plugins/timelines/public/components/t_grid/integrated/index.tsx
+++ b/x-pack/plugins/timelines/public/components/t_grid/integrated/index.tsx
@@ -4,6 +4,8 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+
+import { AlertConsumers } from '@kbn/rule-data-utils/target/alerts_as_data_rbac';
 import { EuiFlexGroup, EuiFlexItem, EuiPanel } from '@elastic/eui';
 import { isEmpty } from 'lodash/fp';
 import React, { useEffect, useMemo, useState } from 'react';
@@ -15,7 +17,7 @@ import { Direction } from '../../../../common/search_strategy';
 import type { DocValueFields } from '../../../../common/search_strategy';
 import type { CoreStart } from '../../../../../../../src/core/public';
 import type { BrowserFields } from '../../../../common/search_strategy/index_fields';
-import { TimelineId, TimelineTabs } from '../../../../common/types/timeline';
+import { TGridCellAction, TimelineId, TimelineTabs } from '../../../../common/types/timeline';
 import type {
   CellValueElementProps,
   ColumnHeaderOptions,
@@ -100,10 +102,13 @@ const HeaderFilterGroupWrapper = styled.header<{ show: boolean }>`
   ${({ show }) => (show ? '' : 'visibility: hidden;')}
 `;
 
+const SECURITY_ALERTS_CONSUMERS = [AlertConsumers.SIEM];
+
 export interface TGridIntegratedProps {
   browserFields: BrowserFields;
   columns: ColumnHeaderOptions[];
   dataProviders: DataProvider[];
+  defaultCellActions?: TGridCellAction[];
   deletedEventIds: Readonly<string[]>;
   docValueFields: DocValueFields[];
   end: string;
@@ -138,6 +143,7 @@ export interface TGridIntegratedProps {
 const TGridIntegratedComponent: React.FC<TGridIntegratedProps> = ({
   browserFields,
   columns,
+  defaultCellActions,
   dataProviders,
   deletedEventIds,
   docValueFields,
@@ -235,6 +241,7 @@ const TGridIntegratedComponent: React.FC<TGridIntegratedProps> = ({
     loading,
     { events, updatedAt, loadPage, pageInfo, refetch, totalCount = 0, inspect },
   ] = useTimelineEvents({
+    alertConsumers: SECURITY_ALERTS_CONSUMERS,
     docValueFields,
     fields,
     filterQuery: combinedQueries!.filterQuery,
@@ -309,6 +316,7 @@ const TGridIntegratedComponent: React.FC<TGridIntegratedProps> = ({
                     activePage={pageInfo.activePage}
                     browserFields={browserFields}
                     data={nonDeletedEvents}
+                    defaultCellActions={defaultCellActions}
                     id={id}
                     isEventViewer={true}
                     loadPage={loadPage}
diff --git a/x-pack/plugins/timelines/public/components/t_grid/standalone/index.tsx b/x-pack/plugins/timelines/public/components/t_grid/standalone/index.tsx
index 7caa6479a583c7..df8a5897bfcd12 100644
--- a/x-pack/plugins/timelines/public/components/t_grid/standalone/index.tsx
+++ b/x-pack/plugins/timelines/public/components/t_grid/standalone/index.tsx
@@ -4,6 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import type { AlertConsumers } from '@kbn/rule-data-utils/target/alerts_as_data_rbac';
 import { EuiFlexGroup, EuiFlexItem, EuiPanel } from '@elastic/eui';
 import { isEmpty } from 'lodash/fp';
 import React, { useEffect, useMemo, useState } from 'react';
@@ -13,7 +14,7 @@ import { useDispatch } from 'react-redux';
 import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
 import { Direction } from '../../../../common/search_strategy';
 import type { CoreStart } from '../../../../../../../src/core/public';
-import { TimelineTabs } from '../../../../common/types/timeline';
+import { TGridCellAction, TimelineTabs } from '../../../../common/types/timeline';
 import type {
   CellValueElementProps,
   ColumnHeaderOptions,
@@ -97,7 +98,9 @@ const HeaderFilterGroupWrapper = styled.header<{ show: boolean }>`
 `;
 
 export interface TGridStandaloneProps {
+  alertConsumers: AlertConsumers[];
   columns: ColumnHeaderOptions[];
+  defaultCellActions?: TGridCellAction[];
   deletedEventIds: Readonly<string[]>;
   end: string;
   loadingText: React.ReactNode;
@@ -126,7 +129,9 @@ export interface TGridStandaloneProps {
 const basicUnit = (n: number) => i18n.UNIT(n);
 
 const TGridStandaloneComponent: React.FC<TGridStandaloneProps> = ({
+  alertConsumers,
   columns,
+  defaultCellActions,
   deletedEventIds,
   end,
   loadingText,
@@ -219,6 +224,7 @@ const TGridStandaloneComponent: React.FC<TGridStandaloneProps> = ({
     loading,
     { events, updatedAt, loadPage, pageInfo, refetch, totalCount = 0, inspect },
   ] = useTimelineEvents({
+    alertConsumers,
     docValueFields: [],
     excludeEcsData: true,
     fields,
@@ -322,6 +328,7 @@ const TGridStandaloneComponent: React.FC<TGridStandaloneProps> = ({
                     activePage={pageInfo.activePage}
                     browserFields={browserFields}
                     data={nonDeletedEvents}
+                    defaultCellActions={defaultCellActions}
                     id={STANDALONE_ID}
                     isEventViewer={true}
                     loadPage={loadPage}
diff --git a/x-pack/plugins/timelines/public/container/index.tsx b/x-pack/plugins/timelines/public/container/index.tsx
index c00d3ea7f934eb..5fb0ed56afaae3 100644
--- a/x-pack/plugins/timelines/public/container/index.tsx
+++ b/x-pack/plugins/timelines/public/container/index.tsx
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import type { AlertConsumers } from '@kbn/rule-data-utils/target/alerts_as_data_rbac';
 import deepEqual from 'fast-deep-equal';
 import { isEmpty, isString, noop } from 'lodash/fp';
 import { useCallback, useEffect, useRef, useState } from 'react';
@@ -80,6 +81,7 @@ export interface UseTimelineEventsProps {
   startDate: string;
   timerangeKind?: 'absolute' | 'relative';
   data?: DataPublicPluginStart;
+  alertConsumers?: AlertConsumers[];
 }
 
 const createFilter = (filterQuery: ESQuery | string | undefined) =>
@@ -106,7 +108,9 @@ export const initSortDefault = [
   },
 ];
 
+const NO_CONSUMERS: AlertConsumers[] = [];
 export const useTimelineEvents = ({
+  alertConsumers = NO_CONSUMERS,
   docValueFields,
   endDate,
   excludeEcsData = false,
@@ -185,11 +189,16 @@ export const useTimelineEvents = ({
         setLoading(true);
         if (data && data.search) {
           searchSubscription$.current = data.search
-            .search<TimelineRequest<typeof language>, TimelineResponse<typeof language>>(request, {
-              strategy:
-                request.language === 'eql' ? 'timelineEqlSearchStrategy' : 'timelineSearchStrategy',
-              abortSignal: abortCtrl.current.signal,
-            })
+            .search<TimelineRequest<typeof language>, TimelineResponse<typeof language>>(
+              { ...request, entityType: 'alerts' },
+              {
+                strategy:
+                  request.language === 'eql'
+                    ? 'timelineEqlSearchStrategy'
+                    : 'timelineSearchStrategy',
+                abortSignal: abortCtrl.current.signal,
+              }
+            )
             .subscribe({
               next: (response) => {
                 if (isCompleteResponse(response)) {
@@ -262,6 +271,7 @@ export const useTimelineEvents = ({
         : 0;
 
       const currentRequest = {
+        alertConsumers,
         defaultIndex: indexNames,
         docValueFields: docValueFields ?? [],
         excludeEcsData,
@@ -291,6 +301,7 @@ export const useTimelineEvents = ({
       return prevRequest;
     });
   }, [
+    alertConsumers,
     dispatch,
     indexNames,
     activePage,
diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/index.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/index.ts
index 431a71faf847e4..dfba32f8a238ce 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/index.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/index.ts
@@ -11,7 +11,7 @@ import { from } from 'rxjs';
 import {
   isValidFeatureId,
   mapConsumerToIndexName,
-  ALERTS_CONSUMERS,
+  AlertConsumers,
 } from '@kbn/rule-data-utils/target/alerts_as_data_rbac';
 
 import {
@@ -125,7 +125,7 @@ const timelineAlertsSearchStrategy = <T extends TimelineFactoryQueryTypes>({
   deps: SearchStrategyDependencies;
   alerting: AlertingPluginStartContract;
   queryFactory: TimelineFactory<T>;
-  alertConsumers: ALERTS_CONSUMERS[];
+  alertConsumers: AlertConsumers[];
 }) => {
   // Based on what solution alerts you want to see, figures out what corresponding
   // index to query (ex: siem --> .alerts-security.alerts)
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index cf3d52dca61679..34cef30b2c3a7b 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -715,23 +715,6 @@
     "data.advancedSettings.defaultIndexTitle": "デフォルトのインデックス",
     "data.advancedSettings.docTableHighlightText": "Discover と保存された検索ダッシュボードの結果をハイライトします。ハイライトすることで、大きなドキュメントを扱う際にリクエストが遅くなります。",
     "data.advancedSettings.docTableHighlightTitle": "結果をハイライト",
-    "data.advancedSettings.format.bytesFormat.numeralFormatLinkText": "数字フォーマット",
-    "data.advancedSettings.format.bytesFormatText": "「バイト」フォーマットのデフォルト{numeralFormatLink}です",
-    "data.advancedSettings.format.bytesFormatTitle": "バイトフォーマット",
-    "data.advancedSettings.format.currencyFormat.numeralFormatLinkText": "数字フォーマット",
-    "data.advancedSettings.format.currencyFormatText": "「通貨」フォーマットのデフォルト{numeralFormatLink}です",
-    "data.advancedSettings.format.currencyFormatTitle": "通貨フォーマット",
-    "data.advancedSettings.format.defaultTypeMapText": "各フィールドタイプにデフォルトで使用するフォーマット名のマップです。フィールドタイプが特に指定されていない場合は {defaultFormat} が使用されます",
-    "data.advancedSettings.format.defaultTypeMapTitle": "フィールドタイプフォーマット名",
-    "data.advancedSettings.format.formattingLocale.numeralLanguageLinkText": "数字言語",
-    "data.advancedSettings.format.formattingLocaleText": "{numeralLanguageLink} ロケール",
-    "data.advancedSettings.format.formattingLocaleTitle": "フォーマットロケール",
-    "data.advancedSettings.format.numberFormat.numeralFormatLinkText": "数字フォーマット",
-    "data.advancedSettings.format.numberFormatText": "「数字」フォーマットのデフォルト{numeralFormatLink}です",
-    "data.advancedSettings.format.numberFormatTitle": "数字フォーマット",
-    "data.advancedSettings.format.percentFormat.numeralFormatLinkText": "数字フォーマット",
-    "data.advancedSettings.format.percentFormatText": "「パーセント」フォーマットのデフォルト{numeralFormatLink}です",
-    "data.advancedSettings.format.percentFormatTitle": "パーセントフォーマット",
     "data.advancedSettings.histogram.barTargetText": "日付ヒストグラムで「自動」間隔を使用する際、この数に近いバケットの作成を試みます",
     "data.advancedSettings.histogram.barTargetTitle": "目標バケット数",
     "data.advancedSettings.histogram.maxBarsText": "Kibana全体で日付の密度とヒストグラム数を制限し、\n          テストクエリを使用するときのパフォーマンスを向上させます。テストクエリのバケットが多すぎる場合は、\n          バケットの間隔が増えます。この設定は個別に\n          各ヒストグラムアグリゲーションに適用されます。他の種類のアグリゲーションには適用されません。\n          この設定の最大値を求めるには、Elasticsearch「search.max_buckets」\n          値を各ビジュアライゼーションのアグリゲーションの最大数で除算します。",
@@ -755,8 +738,6 @@
     "data.advancedSettings.searchQueryLanguageTitle": "クエリ言語",
     "data.advancedSettings.searchTimeout": "検索タイムアウト",
     "data.advancedSettings.searchTimeoutDesc": "検索セッションの最大タイムアウトを変更するか、0 に設定してタイムアウトを無効にすると、クエリは完了するまで実行されます。",
-    "data.advancedSettings.shortenFieldsText": "長いフィールドを短くします。例：foo.bar.bazの代わりにf.b.bazと表示",
-    "data.advancedSettings.shortenFieldsTitle": "フィールドの短縮",
     "data.advancedSettings.sortOptions.optionsLinkText": "オプション",
     "data.advancedSettings.sortOptionsText": "Elasticsearch の並べ替えパラメーターの {optionsLink}",
     "data.advancedSettings.sortOptionsTitle": "並べ替えオプション",
@@ -782,62 +763,6 @@
     "data.aggTypes.buckets.ranges.rangesFormatMessage": "{gte} {from} と {lt} {to}",
     "data.aggTypes.buckets.ranges.rangesFormatMessageArrowRight": "{from} → {to}",
     "data.errors.fetchError": "ネットワークとプロキシ構成を確認してください。問題が解決しない場合は、ネットワーク管理者に問い合わせてください。",
-    "data.fieldFormats.boolean.title": "ブール",
-    "data.fieldFormats.bytes.title": "バイト",
-    "data.fieldFormats.color.title": "色",
-    "data.fieldFormats.date_nanos.title": "日付ナノ",
-    "data.fieldFormats.date.title": "日付",
-    "data.fieldFormats.duration.inputFormats.days": "日",
-    "data.fieldFormats.duration.inputFormats.hours": "時間",
-    "data.fieldFormats.duration.inputFormats.microseconds": "マイクロ秒",
-    "data.fieldFormats.duration.inputFormats.milliseconds": "ミリ秒",
-    "data.fieldFormats.duration.inputFormats.minutes": "分",
-    "data.fieldFormats.duration.inputFormats.months": "か月",
-    "data.fieldFormats.duration.inputFormats.nanoseconds": "ナノ秒",
-    "data.fieldFormats.duration.inputFormats.picoseconds": "ピコ秒",
-    "data.fieldFormats.duration.inputFormats.seconds": "秒",
-    "data.fieldFormats.duration.inputFormats.weeks": "週間",
-    "data.fieldFormats.duration.inputFormats.years": "年",
-    "data.fieldFormats.duration.negativeLabel": "マイナス",
-    "data.fieldFormats.duration.outputFormats.asDays": "日",
-    "data.fieldFormats.duration.outputFormats.asDays.short": "d",
-    "data.fieldFormats.duration.outputFormats.asHours": "時間",
-    "data.fieldFormats.duration.outputFormats.asHours.short": "h",
-    "data.fieldFormats.duration.outputFormats.asMilliseconds": "ミリ秒",
-    "data.fieldFormats.duration.outputFormats.asMilliseconds.short": "ms",
-    "data.fieldFormats.duration.outputFormats.asMinutes": "分",
-    "data.fieldFormats.duration.outputFormats.asMinutes.short": "分",
-    "data.fieldFormats.duration.outputFormats.asMonths": "か月",
-    "data.fieldFormats.duration.outputFormats.asMonths.short": "mon",
-    "data.fieldFormats.duration.outputFormats.asSeconds": "秒",
-    "data.fieldFormats.duration.outputFormats.asSeconds.short": "s",
-    "data.fieldFormats.duration.outputFormats.asWeeks": "週間",
-    "data.fieldFormats.duration.outputFormats.asWeeks.short": "w",
-    "data.fieldFormats.duration.outputFormats.asYears": "年",
-    "data.fieldFormats.duration.outputFormats.asYears.short": "y",
-    "data.fieldFormats.duration.outputFormats.humanize.approximate": "人間が読み取り可能 (近似値) ",
-    "data.fieldFormats.duration.outputFormats.humanize.precise": "人間が読み取り可能 (正確な値) ",
-    "data.fieldFormats.duration.title": "期間",
-    "data.fieldFormats.histogram.title": "ヒストグラム",
-    "data.fieldFormats.ip.title": "IP アドレス",
-    "data.fieldFormats.number.title": "数字",
-    "data.fieldFormats.percent.title": "割合 (%) ",
-    "data.fieldFormats.relative_date.title": "相対日付",
-    "data.fieldFormats.static_lookup.title": "静的ルックアップ",
-    "data.fieldFormats.string.emptyLabel": " (空) ",
-    "data.fieldFormats.string.title": "文字列",
-    "data.fieldFormats.string.transformOptions.base64": "Base64 デコード",
-    "data.fieldFormats.string.transformOptions.lower": "小文字",
-    "data.fieldFormats.string.transformOptions.none": "- なし -",
-    "data.fieldFormats.string.transformOptions.short": "短い点線",
-    "data.fieldFormats.string.transformOptions.title": "タイトルケース",
-    "data.fieldFormats.string.transformOptions.upper": "大文字",
-    "data.fieldFormats.string.transformOptions.url": "URL パラメーターデコード",
-    "data.fieldFormats.truncated_string.title": "切り詰めた文字列",
-    "data.fieldFormats.url.title": "Url",
-    "data.fieldFormats.url.types.audio": "音声",
-    "data.fieldFormats.url.types.img": "画像",
-    "data.fieldFormats.url.types.link": "リンク",
     "data.filter.applyFilterActionTitle": "現在のビューにフィルターを適用",
     "data.filter.applyFilters.popupHeader": "適用するフィルターの選択",
     "data.filter.applyFiltersPopup.cancelButtonLabel": "キャンセル",
@@ -1949,6 +1874,81 @@
     "expressions.functions.varset.name.help": "変数の名前を指定します。",
     "expressions.functions.varset.val.help": "変数の値を指定します。指定しないと、入力コンテキストが使用されます。",
     "expressions.types.number.fromStringConversionErrorMessage": "\"{string}\" 文字列を数字に変換できません",
+    "fieldFormats.advancedSettings.format.bytesFormat.numeralFormatLinkText": "数字フォーマット",
+    "fieldFormats.advancedSettings.format.bytesFormatText": "「バイト」フォーマットのデフォルト{numeralFormatLink}です",
+    "fieldFormats.advancedSettings.format.bytesFormatTitle": "バイトフォーマット",
+    "fieldFormats.advancedSettings.format.currencyFormat.numeralFormatLinkText": "数字フォーマット",
+    "fieldFormats.advancedSettings.format.currencyFormatText": "「通貨」フォーマットのデフォルト{numeralFormatLink}です",
+    "fieldFormats.advancedSettings.format.currencyFormatTitle": "通貨フォーマット",
+    "fieldFormats.advancedSettings.format.defaultTypeMapText": "各フィールドタイプにデフォルトで使用するフォーマット名のマップです。フィールドタイプが特に指定されていない場合は {defaultFormat} が使用されます",
+    "fieldFormats.advancedSettings.format.defaultTypeMapTitle": "フィールドタイプフォーマット名",
+    "fieldFormats.advancedSettings.format.formattingLocale.numeralLanguageLinkText": "数字言語",
+    "fieldFormats.advancedSettings.format.formattingLocaleText": "{numeralLanguageLink} ロケール",
+    "fieldFormats.advancedSettings.format.formattingLocaleTitle": "フォーマットロケール",
+    "fieldFormats.advancedSettings.format.numberFormat.numeralFormatLinkText": "数字フォーマット",
+    "fieldFormats.advancedSettings.format.numberFormatText": "「数字」フォーマットのデフォルト{numeralFormatLink}です",
+    "fieldFormats.advancedSettings.format.numberFormatTitle": "数字フォーマット",
+    "fieldFormats.advancedSettings.format.percentFormat.numeralFormatLinkText": "数字フォーマット",
+    "fieldFormats.advancedSettings.format.percentFormatText": "「パーセント」フォーマットのデフォルト{numeralFormatLink}です",
+    "fieldFormats.advancedSettings.format.percentFormatTitle": "パーセントフォーマット",
+    "fieldFormats.advancedSettings.shortenFieldsText": "長いフィールドを短くします。例：foo.bar.bazの代わりにf.b.bazと表示",
+    "fieldFormats.advancedSettings.shortenFieldsTitle": "フィールドの短縮",
+    "fieldFormats.boolean.title": "ブール",
+    "fieldFormats.bytes.title": "バイト",
+    "fieldFormats.color.title": "色",
+    "fieldFormats.date_nanos.title": "日付ナノ",
+    "fieldFormats.date.title": "日付",
+    "fieldFormats.duration.inputFormats.days": "日",
+    "fieldFormats.duration.inputFormats.hours": "時間",
+    "fieldFormats.duration.inputFormats.microseconds": "マイクロ秒",
+    "fieldFormats.duration.inputFormats.milliseconds": "ミリ秒",
+    "fieldFormats.duration.inputFormats.minutes": "分",
+    "fieldFormats.duration.inputFormats.months": "か月",
+    "fieldFormats.duration.inputFormats.nanoseconds": "ナノ秒",
+    "fieldFormats.duration.inputFormats.picoseconds": "ピコ秒",
+    "fieldFormats.duration.inputFormats.seconds": "秒",
+    "fieldFormats.duration.inputFormats.weeks": "週間",
+    "fieldFormats.duration.inputFormats.years": "年",
+    "fieldFormats.duration.negativeLabel": "マイナス",
+    "fieldFormats.duration.outputFormats.asDays": "日",
+    "fieldFormats.duration.outputFormats.asDays.short": "d",
+    "fieldFormats.duration.outputFormats.asHours": "時間",
+    "fieldFormats.duration.outputFormats.asHours.short": "h",
+    "fieldFormats.duration.outputFormats.asMilliseconds": "ミリ秒",
+    "fieldFormats.duration.outputFormats.asMilliseconds.short": "ms",
+    "fieldFormats.duration.outputFormats.asMinutes": "分",
+    "fieldFormats.duration.outputFormats.asMinutes.short": "分",
+    "fieldFormats.duration.outputFormats.asMonths": "か月",
+    "fieldFormats.duration.outputFormats.asMonths.short": "mon",
+    "fieldFormats.duration.outputFormats.asSeconds": "秒",
+    "fieldFormats.duration.outputFormats.asSeconds.short": "s",
+    "fieldFormats.duration.outputFormats.asWeeks": "週間",
+    "fieldFormats.duration.outputFormats.asWeeks.short": "w",
+    "fieldFormats.duration.outputFormats.asYears": "年",
+    "fieldFormats.duration.outputFormats.asYears.short": "y",
+    "fieldFormats.duration.outputFormats.humanize.approximate": "人間が読み取り可能 (近似値) ",
+    "fieldFormats.duration.outputFormats.humanize.precise": "人間が読み取り可能 (正確な値) ",
+    "fieldFormats.duration.title": "期間",
+    "fieldFormats.histogram.title": "ヒストグラム",
+    "fieldFormats.ip.title": "IP アドレス",
+    "fieldFormats.number.title": "数字",
+    "fieldFormats.percent.title": "割合 (%) ",
+    "fieldFormats.relative_date.title": "相対日付",
+    "fieldFormats.static_lookup.title": "静的ルックアップ",
+    "fieldFormats.string.emptyLabel": " (空) ",
+    "fieldFormats.string.title": "文字列",
+    "fieldFormats.string.transformOptions.base64": "Base64 デコード",
+    "fieldFormats.string.transformOptions.lower": "小文字",
+    "fieldFormats.string.transformOptions.none": "- なし -",
+    "fieldFormats.string.transformOptions.short": "短い点線",
+    "fieldFormats.string.transformOptions.title": "タイトルケース",
+    "fieldFormats.string.transformOptions.upper": "大文字",
+    "fieldFormats.string.transformOptions.url": "URL パラメーターデコード",
+    "fieldFormats.truncated_string.title": "切り詰めた文字列",
+    "fieldFormats.url.title": "Url",
+    "fieldFormats.url.types.audio": "音声",
+    "fieldFormats.url.types.img": "画像",
+    "fieldFormats.url.types.link": "リンク",
     "flot.pie.unableToDrawLabelsInsideCanvasErrorMessage": "キャンバス内のラベルではパイを作成できません",
     "flot.time.aprLabel": "4 月",
     "flot.time.augLabel": "8 月",
@@ -2894,62 +2894,8 @@
     "indexPatternManagement.actions.createButton": "フィールドを作成",
     "indexPatternManagement.actions.deleteButton": "削除",
     "indexPatternManagement.actions.saveButton": "フィールドを保存",
-    "indexPatternManagement.aliasLabel": "エイリアス",
     "indexPatternManagement.createHeader": "スクリプトフィールドを作成",
-    "indexPatternManagement.createIndexPattern.betaLabel": "ベータ",
-    "indexPatternManagement.createIndexPattern.description": "インデックスパターンは、{single}または{multiple}データソース、{star}と一致します。",
-    "indexPatternManagement.createIndexPattern.documentation": "ドキュメンテーションを表示",
-    "indexPatternManagement.createIndexPattern.emptyState.checkDataButton": "新規データを確認",
-    "indexPatternManagement.createIndexPattern.emptyState.createAnyway": "一部のインデックスは表示されない場合があります。{link}してください。",
-    "indexPatternManagement.createIndexPattern.emptyState.createAnywayLink": "インデックスパターンを作成します",
-    "indexPatternManagement.createIndexPattern.emptyState.haveData": "すでにデータがある場合",
-    "indexPatternManagement.createIndexPattern.emptyState.integrationCardDescription": "さまざまなソースからデータを追加します。",
-    "indexPatternManagement.createIndexPattern.emptyState.integrationCardTitle": "統合の追加",
-    "indexPatternManagement.createIndexPattern.emptyState.learnMore": "詳細について",
-    "indexPatternManagement.createIndexPattern.emptyState.noDataTitle": "Kibanaを試しますか？まずデータが必要です。",
-    "indexPatternManagement.createIndexPattern.emptyState.readDocs": "ドキュメンテーションを表示",
-    "indexPatternManagement.createIndexPattern.emptyState.sampleDataCardDescription": "データセットとKibanaダッシュボードを読み込みます。",
-    "indexPatternManagement.createIndexPattern.emptyState.sampleDataCardTitle": "サンプルデータの追加",
-    "indexPatternManagement.createIndexPattern.emptyState.uploadCardDescription": "CSV、NDJSON、またはログファイルをインポートします。",
-    "indexPatternManagement.createIndexPattern.emptyState.uploadCardTitle": "ファイルをアップロード",
-    "indexPatternManagement.createIndexPattern.includeSystemIndicesToggleSwitchLabel": "システムと非表示のインデックスを含める",
-    "indexPatternManagement.createIndexPattern.loadClustersFailMsg": "リモートクラスターの読み込みに失敗",
-    "indexPatternManagement.createIndexPattern.loadIndicesFailMsg": "インデックスの読み込みに失敗",
-    "indexPatternManagement.createIndexPattern.loadingState.checkingLabel": "Elasticsearchデータを確認中",
-    "indexPatternManagement.createIndexPattern.step.indexPattern.allowLabel": "複数インデックスの一致にアスタリスク ({asterisk}) を使用。",
-    "indexPatternManagement.createIndexPattern.step.indexPattern.disallowLabel": "スペースと{characterList}は使用できません。",
-    "indexPatternManagement.createIndexPattern.step.indexPatternLabel": "インデックスパターン名",
-    "indexPatternManagement.createIndexPattern.step.indexPatternPlaceholder": "index-name-*",
-    "indexPatternManagement.createIndexPattern.step.invalidCharactersErrorMessage": "{indexPatternName}にはスペースや{characterList}は使えません。",
-    "indexPatternManagement.createIndexPattern.step.loadingHeader": "一致するインデックスを検索中…",
-    "indexPatternManagement.createIndexPattern.step.nextStepButton": "次のステップ",
-    "indexPatternManagement.createIndexPattern.step.pagingLabel": "ページごとの行数：{perPage}",
-    "indexPatternManagement.createIndexPattern.step.status.noSystemIndicesLabel": "パターンに一致するElasticsearchインデックスがありません。",
-    "indexPatternManagement.createIndexPattern.step.status.noSystemIndicesWithPromptLabel": "パターンに一致するElasticsearchインデックスがありません。一致するシステムインデックスを表示するには、上のスイッチを切り替えます。",
-    "indexPatternManagement.createIndexPattern.step.warningHeader": "すでに{query}という名前のインデックスパターンがあります。",
-    "indexPatternManagement.createIndexPattern.stepHeader": "ステップ1/2：インデックスパターンを定義",
-    "indexPatternManagement.createIndexPattern.stepTime.backButton": "戻る",
-    "indexPatternManagement.createIndexPattern.stepTime.createPatternButton": "インデックスパターンを作成",
-    "indexPatternManagement.createIndexPattern.stepTime.creatingLabel": "インデックスパターンを作成中…",
-    "indexPatternManagement.createIndexPattern.stepTime.error": "エラー",
-    "indexPatternManagement.createIndexPattern.stepTime.field.loadingDropDown": "読み込み中…",
-    "indexPatternManagement.createIndexPattern.stepTime.field.noTimeFieldsLabel": "このインデックスパターンに一致するインデックスには時間フィールドがありません。",
-    "indexPatternManagement.createIndexPattern.stepTime.fieldLabel": "時間フィールド",
-    "indexPatternManagement.createIndexPattern.stepTime.noTimeFieldOptionLabel": "時間フィルターを使用しない",
-    "indexPatternManagement.createIndexPattern.stepTime.noTimeFieldsLabel": "このインデックスパターンに一致するインデックスには時間フィールドがありません。",
-    "indexPatternManagement.createIndexPattern.stepTime.options.hideButton": "高度なSIEM設定の非表示化",
-    "indexPatternManagement.createIndexPattern.stepTime.options.patternHeader": "カスタムインデックスパターンID",
-    "indexPatternManagement.createIndexPattern.stepTime.options.patternLabel": "Kibanaはそれぞれのインデックスパターンに固有の識別子を割り当てます。固有のIDを使用しない場合は、カスタムIDを入力してください。",
-    "indexPatternManagement.createIndexPattern.stepTime.options.patternPlaceholder": "custom-index-pattern-id",
-    "indexPatternManagement.createIndexPattern.stepTime.options.showButton": "高度なSIEM設定の表示",
-    "indexPatternManagement.createIndexPattern.stepTime.patterAlreadyExists": "カスタムインデックスパターンIDがすでに存在します。",
-    "indexPatternManagement.createIndexPattern.stepTime.refreshButton": "更新",
-    "indexPatternManagement.createIndexPattern.stepTime.timeDescription": "グローバル時間フィルターで使用するためのプライマリ時間フィールドを選択してください。",
-    "indexPatternManagement.createIndexPattern.stepTimeHeader": "ステップ2/2：設定の構成",
-    "indexPatternManagement.createIndexPattern.stepTimeLabel": "{indexPattern} {indexPatternName}の設定を指定します。",
-    "indexPatternManagement.createIndexPatternHeader": "{indexPatternName}の作成",
     "indexPatternManagement.customLabel": "カスタムラベル",
-    "indexPatternManagement.dataStreamLabel": "データストリーム",
     "indexPatternManagement.defaultFormatDropDown": "- デフォルト -",
     "indexPatternManagement.defaultFormatHeader": "フォーマット (デフォルト：{defaultFormat}) ",
     "indexPatternManagement.deleteField.cancelButton": "キャンセル",
@@ -2961,9 +2907,6 @@
     "indexPatternManagement.disabledCallOutHeader": "スクリプティングが無効です",
     "indexPatternManagement.disabledCallOutLabel": "Elasticsearchでのすべてのインラインスクリプティングが無効になっています。Kibanaでスクリプトフィールドを使用するには、インラインスクリプティングを有効にする必要があります。",
     "indexPatternManagement.editHeader": "{fieldName}を編集",
-    "indexPatternManagement.editIndexPattern.createIndex.defaultButtonDescription": "すべてのデータに完全アグリゲーションを実行",
-    "indexPatternManagement.editIndexPattern.createIndex.defaultButtonText": "標準インデックスパターン",
-    "indexPatternManagement.editIndexPattern.createIndex.defaultTypeName": "インデックスパターン",
     "indexPatternManagement.editIndexPattern.deleteButton": "削除",
     "indexPatternManagement.editIndexPattern.deleteHeader": "インデックスパターンを削除しますか？",
     "indexPatternManagement.editIndexPattern.deprecation": "スクリプトフィールドは廃止予定です。代わりに{runtimeDocs}を使用してください。",
@@ -3048,31 +2991,12 @@
     "indexPatternManagement.editIndexPattern.timeFilterHeader": "時刻フィールド：「{timeFieldName}」",
     "indexPatternManagement.editIndexPattern.timeFilterLabel.mappingAPILink": "フィールドマッピング",
     "indexPatternManagement.editIndexPattern.timeFilterLabel.timeFilterDetail": "{indexPatternTitle}でフィールドを表示して編集します。型や検索可否などのフィールド属性はElasticsearchで{mappingAPILink}に基づきます。",
-    "indexPatternManagement.editRollupIndexPattern.createIndex.defaultButtonDescription": "要約データに制限された集約を実行します。",
-    "indexPatternManagement.editRollupIndexPattern.createIndex.defaultButtonText": "ロールアップインデックスパターン",
-    "indexPatternManagement.editRollupIndexPattern.createIndex.defaultTypeName": "ロールアップインデックスパターン",
-    "indexPatternManagement.editRollupIndexPattern.createIndex.indexLabel": "ロールアップ",
-    "indexPatternManagement.editRollupIndexPattern.createIndex.noMatchError": "ロールアップインデックスパターンエラー：ロールアップインデックスの 1 つと一致している必要があります",
-    "indexPatternManagement.editRollupIndexPattern.createIndex.tooManyMatchesError": "ロールアップインデックスパターンエラー：一致できるロールアップインデックスは 1 つだけです",
-    "indexPatternManagement.editRollupIndexPattern.createIndex.uncaughtError": "ロールアップインデックスパターンエラー：{error}",
-    "indexPatternManagement.editRollupIndexPattern.rollupPrompt.betaCalloutParagraph1Text": "ロールアップインデックスパターンのKibanaのサポートはベータ版です。保存された検索、可視化、ダッシュボードでこれらのパターンを使用すると問題が発生する場合があります。Timelionや機械学習などの一部の高度な機能ではサポートされていません。",
-    "indexPatternManagement.editRollupIndexPattern.rollupPrompt.betaCalloutParagraph2Text": "ロールアップインデックスパターンは、1つのロールアップインデックスとゼロ以上の標準インデックスと一致させることができます。ロールアップインデックスパターンでは、メトリック、フィールド、間隔、アグリゲーションが制限されています。ロールアップインデックスは、1つのジョブ構成があるインデックス、または複数のジョブと互換する構成があるインデックスに制限されています。",
-    "indexPatternManagement.emptyIndexPatternPrompt.documentation": "ドキュメンテーションを表示",
-    "indexPatternManagement.emptyIndexPatternPrompt.indexPatternExplanation": "Kibanaでは、検索するインデックスを特定するためにインデックスパターンが必要です。インデックスパターンは、昨日のログデータなど特定のインデックス、またはログデータを含むすべてのインデックスを参照できます。",
-    "indexPatternManagement.emptyIndexPatternPrompt.learnMore": "詳細について",
-    "indexPatternManagement.emptyIndexPatternPrompt.nowCreate": "インデックスパターンを作成します。",
-    "indexPatternManagement.emptyIndexPatternPrompt.youHaveData": "Elasticsearchにデータがあります。",
     "indexPatternManagement.fieldTypeConflict": "フィールドタイプの矛盾",
     "indexPatternManagement.formatHeader": "フォーマット",
     "indexPatternManagement.formatLabel": "フォーマットは、特定の値の表示形式を管理できます。また、値を完全に変更したり、Discover でのハイライト機能を無効にしたりすることも可能です。",
-    "indexPatternManagement.frozenLabel": "凍結",
     "indexPatternManagement.header.runtimeLink": "ランタイムフィールド",
-    "indexPatternManagement.indexLabel": "インデックス",
     "indexPatternManagement.indexNameLabel": "インデックス名",
-    "indexPatternManagement.indexPattern.goToPatternButtonLabel": "既存のパターンに移動",
     "indexPatternManagement.indexPattern.sectionsHeader": "インデックスパターン",
-    "indexPatternManagement.indexPattern.titleExistsLabel": "「{title}」というタイトルのインデックスパターンがすでに存在します。",
-    "indexPatternManagement.indexPatternList.createButton.betaLabel": "ベータ",
     "indexPatternManagement.indexPatterns.badge.readOnly.text": "読み取り専用",
     "indexPatternManagement.indexPatterns.badge.readOnly.tooltip": "インデックスパターンを保存できません",
     "indexPatternManagement.indexPatterns.createBreadcrumb": "インデックスパターンを作成",
@@ -5198,11 +5122,6 @@
     "visTypeXy.function.valueAxis.axisParams.help": "値軸パラメーター",
     "visTypeXy.function.valueaxis.help": "値軸オブジェクトを生成します",
     "visTypeXy.function.valueAxis.name.help": "値軸の名前",
-    "visualizations.function.xyDimension.aggType.help": "集約タイプ",
-    "visualizations.function.xydimension.help": "XYディメンションオブジェクトを生成します",
-    "visualizations.function.xyDimension.label.help": "ラベル",
-    "visualizations.function.xyDimension.params.help": "パラメーター",
-    "visualizations.function.xyDimension.visDimension.help": "ディメンションオブジェクト構成",
     "visTypeXy.functions.help": "XYビジュアライゼーション",
     "visTypeXy.histogram.groupTitle": "系列を分割",
     "visTypeXy.histogram.histogramDescription": "軸の縦棒にデータを表示します。",
@@ -5241,6 +5160,11 @@
     "visTypeXy.thresholdLine.style.dashedText": "鎖線",
     "visTypeXy.thresholdLine.style.dotdashedText": "点線",
     "visTypeXy.thresholdLine.style.fullText": "完全",
+    "visualizations.function.xyDimension.aggType.help": "集約タイプ",
+    "visualizations.function.xydimension.help": "XYディメンションオブジェクトを生成します",
+    "visualizations.function.xyDimension.label.help": "ラベル",
+    "visualizations.function.xyDimension.params.help": "パラメーター",
+    "visualizations.function.xyDimension.visDimension.help": "ディメンションオブジェクト構成",
     "visualizations.advancedSettings.visualizeEnableLabsText": "ユーザーが実験的なビジュアライゼーションを作成、表示、編集できるようになります。無効の場合、\n            ユーザーは本番準備が整ったビジュアライゼーションのみを利用できます。",
     "visualizations.advancedSettings.visualizeEnableLabsTitle": "実験的なビジュアライゼーションを有効にする",
     "visualizations.disabledLabVisualizationLink": "ドキュメンテーションを表示",
@@ -5663,8 +5587,6 @@
     "xpack.apm.customLink.empty": "カスタムリンクが見つかりません。独自のカスタムリンク、たとえば特定のダッシュボードまたは外部リンクへのリンクをセットアップします。",
     "xpack.apm.emptyMessage.noDataFoundDescription": "別の時間範囲を試すか検索フィルターをリセットしてください。",
     "xpack.apm.emptyMessage.noDataFoundLabel": "データが見つかりません。",
-    "xpack.apm.enableServiceOverviewExperimentDescription": "APM でサービスの［概要］タブを有効にします。",
-    "xpack.apm.enableServiceOverviewExperimentName": "APM サービス概要",
     "xpack.apm.error.prompt.body": "詳細はブラウザの開発者コンソールをご確認ください。",
     "xpack.apm.error.prompt.title": "申し訳ございませんが、エラーが発生しました : (",
     "xpack.apm.errorCountAlert.name": "エラー数しきい値",
@@ -5891,7 +5813,6 @@
     "xpack.apm.serviceMap.invalidLicenseMessage": "サービスマップを利用するには、Elastic Platinum ライセンスが必要です。これにより、APM データとともにアプリケーションスタックすべてを可視化することができるようになります。",
     "xpack.apm.serviceMap.noServicesPromptDescription": "現在選択されている時間範囲と環境内では、マッピングするサービスが見つかりません。別の範囲を試すか、選択した環境を確認してください。サービスがない場合は、セットアップ手順に従って開始してください。",
     "xpack.apm.serviceMap.noServicesPromptTitle": "サービスが利用できません",
-    "xpack.apm.serviceMap.popoverMetrics.noDataText": "選択した環境のデータがありません。別の環境に切り替えてください。",
     "xpack.apm.serviceMap.resourceCountLabel": "{count}個のリソース",
     "xpack.apm.serviceMap.serviceDetailsButtonText": "サービス詳細",
     "xpack.apm.serviceMap.subtypePopoverStat": "サブタイプ",
@@ -6727,17 +6648,6 @@
     "xpack.canvas.functions.pointseries.args.yHelpText": "Y軸の値です。",
     "xpack.canvas.functions.pointseries.unwrappedExpressionErrorMessage": "表現は {fn} などの関数で囲む必要があります",
     "xpack.canvas.functions.pointseriesHelpText": "{DATATABLE} を点の配列モデルに変換します。現在 {TINYMATH} 式でディメンションのメジャーを区別します。{TINYMATH_URL} をご覧ください。引数に {TINYMATH} 式が入力された場合、その引数をメジャーとして使用し、そうでない場合はディメンションになります。ディメンションを組み合わせて固有のキーを作成します。その後メジャーはそれらのキーで、指定された {TINYMATH} 関数を使用して複製されます。",
-    "expressionShape.functions.progress.args.barColorHelpText": "背景バーの色です。",
-    "expressionShape.functions.progress.args.barWeightHelpText": "背景バーの太さです。",
-    "expressionShape.functions.progress.args.fontHelpText": "ラベルの {CSS} フォントプロパティです。例：{FONT_FAMILY} または {FONT_WEIGHT}。",
-    "expressionShape.functions.progress.args.labelHelpText": "ラベルの表示・非表示を切り替えるには、{BOOLEAN_TRUE}または{BOOLEAN_FALSE}を使用します。また、ラベルとして表示する文字列を入力することもできます。",
-    "expressionShape.functions.progress.args.maxHelpText": "進捗エレメントの最高値です。",
-    "expressionShape.functions.progress.args.shapeHelpText": "{list} または {end} を選択します。",
-    "expressionShape.functions.progress.args.valueColorHelpText": "進捗バーの色です。",
-    "expressionShape.functions.progress.args.valueWeightHelpText": "進捗バーの太さです。",
-    "expressionShape.functions.progress.invalidMaxValueErrorMessage": "無効な {arg} 値：「{max, number}」。「{arg}」は 0 より大きい必要があります",
-    "expressionShape.functions.progress.invalidValueErrorMessage": "無効な値：「{value, number}」。値は 0 と {max, number} の間でなければなりません",
-    "expressionShape.functions.progressHelpText": "進捗エレメントを構成します。",
     "xpack.canvas.functions.render.args.asHelpText": "レンダリングに使用するエレメントタイプです。代わりに {plotFn} や {shapeFn} などの特殊な関数を使用するほうがいいでしょう。",
     "xpack.canvas.functions.render.args.containerStyleHelpText": "背景、境界、透明度を含む、コンテナーのスタイルです。",
     "xpack.canvas.functions.render.args.cssHelpText": "このエレメントの対象となるカスタム {CSS} のブロックです。",
@@ -6926,8 +6836,6 @@
     "xpack.canvas.renderer.pie.helpDescription": "データから円グラフをレンダリングします",
     "xpack.canvas.renderer.plot.displayName": "座標プロット",
     "xpack.canvas.renderer.plot.helpDescription": "データから XY プロットをレンダリングします",
-    "expressionShape.renderer.progress.displayName": "進捗インジケーター",
-    "expressionShape.renderer.progress.helpDescription": "エレメントのパーセンテージを示す進捗インジケーターをレンダリングします",
     "xpack.canvas.renderer.table.displayName": "データテーブル",
     "xpack.canvas.renderer.table.helpDescription": "表形式データを {HTML} としてレンダリングします",
     "xpack.canvas.renderer.text.displayName": "プレインテキスト",
@@ -7411,6 +7319,21 @@
     "xpack.canvas.workpadTemplates.table.descriptionColumnTitle": "説明",
     "xpack.canvas.workpadTemplates.table.nameColumnTitle": "テンプレート名",
     "xpack.canvas.workpadTemplates.table.tagsColumnTitle": "タグ",
+    "expressionShape.functions.progress.args.barColorHelpText": "背景バーの色です。",
+    "expressionShape.functions.progress.args.barWeightHelpText": "背景バーの太さです。",
+    "expressionShape.functions.progress.args.fontHelpText": "ラベルの {CSS} フォントプロパティです。例：{FONT_FAMILY} または {FONT_WEIGHT}。",
+    "expressionShape.functions.progress.args.labelHelpText": "ラベルの表示・非表示を切り替えるには、{BOOLEAN_TRUE}または{BOOLEAN_FALSE}を使用します。また、ラベルとして表示する文字列を入力することもできます。",
+    "expressionShape.functions.progress.args.maxHelpText": "進捗エレメントの最高値です。",
+    "expressionShape.functions.progress.args.shapeHelpText": "{list} または {end} を選択します。",
+    "expressionShape.functions.progress.args.valueColorHelpText": "進捗バーの色です。",
+    "expressionShape.functions.progress.args.valueWeightHelpText": "進捗バーの太さです。",
+    "expressionShape.functions.progress.invalidMaxValueErrorMessage": "無効な {arg} 値：「{max, number}」。「{arg}」は 0 より大きい必要があります",
+    "expressionShape.functions.progress.invalidValueErrorMessage": "無効な値：「{value, number}」。値は 0 と {max, number} の間でなければなりません",
+    "expressionShape.functions.progressHelpText": "進捗エレメントを構成します。",
+    "expressionShape.renderer.progress.displayName": "進捗インジケーター",
+    "expressionShape.renderer.progress.helpDescription": "エレメントのパーセンテージを示す進捗インジケーターをレンダリングします",
+    "expressionShape.renderer.shape.displayName": "形状",
+    "expressionShape.renderer.shape.helpDescription": "基本的な図形をレンダリングします",
     "expressionRepeatImage.error.repeatImage.missingMaxArgument": "{emptyImageArgument} を指定する場合は、{maxArgument} を設定する必要があります",
     "expressionRepeatImage.functions.repeatImage.args.emptyImageHelpText": "この画像のエレメントについて、{CONTEXT}および{maxArg}パラメーターの差異を解消します。画像アセットは{BASE64}データ{URL}として提供するか、部分式で渡します。",
     "expressionRepeatImage.functions.repeatImage.args.imageHelpText": "繰り返す画像です。画像アセットは{BASE64}データ{URL}として提供するか、部分式で渡します。",
@@ -7432,8 +7355,6 @@
     "expressionMetric.functions.metricHelpText": "ラベルの上に数字を表示します。",
     "expressionMetric.renderer.metric.displayName": "メトリック",
     "expressionMetric.renderer.metric.helpDescription": "ラベルの上に数字をレンダリングします",
-    "expressionShape.renderer.shape.displayName": "形状",
-    "expressionShape.renderer.shape.helpDescription": "基本的な図形をレンダリングします",
     "expressionError.errorComponent.description": "表現が失敗し次のメッセージが返されました：",
     "expressionError.errorComponent.title": "おっと！表現が失敗しました",
     "expressionError.renderer.debug.displayName": "デバッグ",
@@ -11627,7 +11548,6 @@
     "xpack.indexLifecycleMgmt.nodeAttrDetails.idField": "ID",
     "xpack.indexLifecycleMgmt.nodeAttrDetails.nameField": "名前",
     "xpack.indexLifecycleMgmt.nodeAttrDetails.title": "属性 {selectedNodeAttrs} を含むノード",
-    "xpack.indexLifecycleMgmt.noMatch.noPolicicesDescription": "表示するポリシーがありません",
     "xpack.indexLifecycleMgmt.numberOfReplicas.formRowTitle": "レプリカ",
     "xpack.indexLifecycleMgmt.optionalMessage": "  (オプション) ",
     "xpack.indexLifecycleMgmt.phaseErrorIcon.tooltipDescription": "このフェーズにはエラーが含まれます。",
@@ -11639,7 +11559,6 @@
     "xpack.indexLifecycleMgmt.policyJsonFlyout.unnamedTitle": "リクエスト",
     "xpack.indexLifecycleMgmt.policyJsonFlyout.validationErrorCallout.body": "このポリシーの JSON を表示するには、すべての検証エラーを解決してください。",
     "xpack.indexLifecycleMgmt.policyJsonFlyout.validationErrorCallout.title": "無効なポリシー",
-    "xpack.indexLifecycleMgmt.policyTable.actionsButtonText": "アクション",
     "xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.cancelButton": "キャンセル",
     "xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.chooseTemplateLabel": "インデックステンプレート",
     "xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.chooseTemplateMessage": "インデックステンプレートを選択してください",
@@ -11654,7 +11573,6 @@
     "xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.templateHasPolicyWarningTitle": "テンプレートにすでにポリシーがあります",
     "xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.title": "インデックステンプレートにポリシー「{name}」 を追加",
     "xpack.indexLifecycleMgmt.policyTable.addPolicyToTemplateButtonText": "インデックステンプレートにポリシーを追加",
-    "xpack.indexLifecycleMgmt.policyTable.deletePolicyButtonDisabledTooltip": "インデックスが使用中のポリシーは削除できません",
     "xpack.indexLifecycleMgmt.policyTable.deletePolicyButtonText": "ポリシーを削除",
     "xpack.indexLifecycleMgmt.policyTable.emptyPrompt.createButtonLabel": "ポリシーを作成",
     "xpack.indexLifecycleMgmt.policyTable.emptyPromptDescription": " ライフサイクルポリシーは、インデックスが古くなるにつれ管理しやすくなります。",
@@ -11662,15 +11580,11 @@
     "xpack.indexLifecycleMgmt.policyTable.headers.linkedIndicesHeader": "リンクされたインデックス",
     "xpack.indexLifecycleMgmt.policyTable.headers.modifiedDateHeader": "変更日",
     "xpack.indexLifecycleMgmt.policyTable.headers.nameHeader": "名前",
-    "xpack.indexLifecycleMgmt.policyTable.headers.versionHeader": "バージョン",
     "xpack.indexLifecycleMgmt.policyTable.policiesLoading": "ポリシーを読み込み中...",
     "xpack.indexLifecycleMgmt.policyTable.policiesLoadingFailedTitle": "既存のライフサイクルポリシーを読み込めません",
     "xpack.indexLifecycleMgmt.policyTable.policiesReloadButton": "再試行",
-    "xpack.indexLifecycleMgmt.policyTable.policyActionsMenu.panelTitle": "ポリシーオプション",
     "xpack.indexLifecycleMgmt.policyTable.sectionDescription": "インデックスが古くなるにつれ管理します。 インデックスのライフサイクルにおける進捗のタイミングと方法を自動化するポリシーを設定します。",
     "xpack.indexLifecycleMgmt.policyTable.sectionHeading": "インデックスライフサイクルポリシー",
-    "xpack.indexLifecycleMgmt.policyTable.systempoliciesSearchInputAriaLabel": "検索ポリシー",
-    "xpack.indexLifecycleMgmt.policyTable.systempoliciesSearchInputPlaceholder": "検索",
     "xpack.indexLifecycleMgmt.policyTable.viewIndicesButtonText": "ポリシーにリンクされたインデックスを表示",
     "xpack.indexLifecycleMgmt.readonlyFieldLabel": "インデックスを読み取り専用にする",
     "xpack.indexLifecycleMgmt.removeIndexLifecycleActionButtonLabel": "ライフサイクルポリシーを削除",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 294759ec121731..8f140ddff43a44 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -718,23 +718,6 @@
     "data.advancedSettings.defaultIndexTitle": "默认索引",
     "data.advancedSettings.docTableHighlightText": "在 Discover 和已保存搜索仪表板中突出显示结果。处理大文档时，突出显示会使请求变慢。",
     "data.advancedSettings.docTableHighlightTitle": "突出显示结果",
-    "data.advancedSettings.format.bytesFormat.numeralFormatLinkText": "数值格式",
-    "data.advancedSettings.format.bytesFormatText": "“字节”格式的默认{numeralFormatLink}",
-    "data.advancedSettings.format.bytesFormatTitle": "字节格式",
-    "data.advancedSettings.format.currencyFormat.numeralFormatLinkText": "数值格式",
-    "data.advancedSettings.format.currencyFormatText": "“货币”格式的默认{numeralFormatLink}",
-    "data.advancedSettings.format.currencyFormatTitle": "货币格式",
-    "data.advancedSettings.format.defaultTypeMapText": "要默认用于每个字段类型的格式名称的映射。如果未显式提及字段类型，则将使用{defaultFormat}",
-    "data.advancedSettings.format.defaultTypeMapTitle": "字段类型格式名称",
-    "data.advancedSettings.format.formattingLocale.numeralLanguageLinkText": "数值语言",
-    "data.advancedSettings.format.formattingLocaleText": "{numeralLanguageLink}区域设置",
-    "data.advancedSettings.format.formattingLocaleTitle": "格式区域设置",
-    "data.advancedSettings.format.numberFormat.numeralFormatLinkText": "数值格式",
-    "data.advancedSettings.format.numberFormatText": "“数字”格式的默认{numeralFormatLink}",
-    "data.advancedSettings.format.numberFormatTitle": "数字格式",
-    "data.advancedSettings.format.percentFormat.numeralFormatLinkText": "数值格式",
-    "data.advancedSettings.format.percentFormatText": "“百分比”格式的默认{numeralFormatLink}",
-    "data.advancedSettings.format.percentFormatTitle": "百分比格式",
     "data.advancedSettings.histogram.barTargetText": "在日期和数值直方图中使用“auto”时间间隔时尝试生成大约此数目的存储桶",
     "data.advancedSettings.histogram.barTargetTitle": "目标存储桶",
     "data.advancedSettings.histogram.maxBarsText": "在 Kibana 中限制日期和数值直方图的密度\n          以提高使用测试查询的性能。如果测试查询有过多的存储桶，\n          存储桶间的时间间隔将会增加。此设置分别应用到\n          各个直方图聚合，不会应用到其他类型的聚合。\n          要查找此设置的最大值，请将 Elasticsearch 'search.max_buckets' 除以\n          各个可视化中的最大聚合数。",
@@ -758,8 +741,6 @@
     "data.advancedSettings.searchQueryLanguageTitle": "查询语言",
     "data.advancedSettings.searchTimeout": "搜索超时",
     "data.advancedSettings.searchTimeoutDesc": "更改搜索会话的最大超时值，或设置为 0 以禁用超时，让查询运行至结束。",
-    "data.advancedSettings.shortenFieldsText": "缩短长字段，例如，不显示 foo.bar.baz，而显示 f.b.baz",
-    "data.advancedSettings.shortenFieldsTitle": "缩短字段",
     "data.advancedSettings.sortOptions.optionsLinkText": "选项",
     "data.advancedSettings.sortOptionsText": "Elasticsearch 排序参数的{optionsLink}",
     "data.advancedSettings.sortOptionsTitle": "排序选项",
@@ -785,62 +766,6 @@
     "data.aggTypes.buckets.ranges.rangesFormatMessage": "{gte} {from} 且 {lt} {to}",
     "data.aggTypes.buckets.ranges.rangesFormatMessageArrowRight": "{from} → {to}",
     "data.errors.fetchError": "请检查您的网络和代理配置。如果问题持续存在，请联系网络管理员。",
-    "data.fieldFormats.boolean.title": "布尔型",
-    "data.fieldFormats.bytes.title": "字节",
-    "data.fieldFormats.color.title": "颜色",
-    "data.fieldFormats.date_nanos.title": "日期纳秒",
-    "data.fieldFormats.date.title": "日期",
-    "data.fieldFormats.duration.inputFormats.days": "天",
-    "data.fieldFormats.duration.inputFormats.hours": "小时",
-    "data.fieldFormats.duration.inputFormats.microseconds": "微秒",
-    "data.fieldFormats.duration.inputFormats.milliseconds": "毫秒",
-    "data.fieldFormats.duration.inputFormats.minutes": "分钟",
-    "data.fieldFormats.duration.inputFormats.months": "月",
-    "data.fieldFormats.duration.inputFormats.nanoseconds": "纳秒",
-    "data.fieldFormats.duration.inputFormats.picoseconds": "皮秒",
-    "data.fieldFormats.duration.inputFormats.seconds": "秒",
-    "data.fieldFormats.duration.inputFormats.weeks": "周",
-    "data.fieldFormats.duration.inputFormats.years": "年",
-    "data.fieldFormats.duration.negativeLabel": "负号",
-    "data.fieldFormats.duration.outputFormats.asDays": "天",
-    "data.fieldFormats.duration.outputFormats.asDays.short": "d",
-    "data.fieldFormats.duration.outputFormats.asHours": "小时",
-    "data.fieldFormats.duration.outputFormats.asHours.short": "h",
-    "data.fieldFormats.duration.outputFormats.asMilliseconds": "毫秒",
-    "data.fieldFormats.duration.outputFormats.asMilliseconds.short": "ms",
-    "data.fieldFormats.duration.outputFormats.asMinutes": "分钟",
-    "data.fieldFormats.duration.outputFormats.asMinutes.short": "最小值",
-    "data.fieldFormats.duration.outputFormats.asMonths": "月",
-    "data.fieldFormats.duration.outputFormats.asMonths.short": "月",
-    "data.fieldFormats.duration.outputFormats.asSeconds": "秒",
-    "data.fieldFormats.duration.outputFormats.asSeconds.short": "s",
-    "data.fieldFormats.duration.outputFormats.asWeeks": "周",
-    "data.fieldFormats.duration.outputFormats.asWeeks.short": "w",
-    "data.fieldFormats.duration.outputFormats.asYears": "年",
-    "data.fieldFormats.duration.outputFormats.asYears.short": "y",
-    "data.fieldFormats.duration.outputFormats.humanize.approximate": "可人工读取（近似）",
-    "data.fieldFormats.duration.outputFormats.humanize.precise": "可人工读取（精确）",
-    "data.fieldFormats.duration.title": "持续时间",
-    "data.fieldFormats.histogram.title": "直方图",
-    "data.fieldFormats.ip.title": "IP 地址",
-    "data.fieldFormats.number.title": "数字",
-    "data.fieldFormats.percent.title": "百分比",
-    "data.fieldFormats.relative_date.title": "相对日期",
-    "data.fieldFormats.static_lookup.title": "静态查找",
-    "data.fieldFormats.string.emptyLabel": "（空）",
-    "data.fieldFormats.string.title": "字符串",
-    "data.fieldFormats.string.transformOptions.base64": "Base64 解码",
-    "data.fieldFormats.string.transformOptions.lower": "小写",
-    "data.fieldFormats.string.transformOptions.none": "- 无 -",
-    "data.fieldFormats.string.transformOptions.short": "短名",
-    "data.fieldFormats.string.transformOptions.title": "标题大小写",
-    "data.fieldFormats.string.transformOptions.upper": "大写",
-    "data.fieldFormats.string.transformOptions.url": "URL 参数解码",
-    "data.fieldFormats.truncated_string.title": "已截短字符串",
-    "data.fieldFormats.url.title": "URL",
-    "data.fieldFormats.url.types.audio": "音频",
-    "data.fieldFormats.url.types.img": "图像",
-    "data.fieldFormats.url.types.link": "链接",
     "data.filter.applyFilterActionTitle": "将筛选应用于当前视图",
     "data.filter.applyFilters.popupHeader": "选择要应用的筛选",
     "data.filter.applyFiltersPopup.cancelButtonLabel": "取消",
@@ -1961,6 +1886,81 @@
     "expressions.functions.varset.val.help": "指定变量的值。如果未指定，则使用输入上下文。",
     "expressions.types.number.fromStringConversionErrorMessage": "无法将“{string}”字符串的类型转换为数字",
     "flot.pie.unableToDrawLabelsInsideCanvasErrorMessage": "无法用画布内包含的标签绘制饼图",
+    "fieldFormats.advancedSettings.shortenFieldsText": "缩短长字段，例如，不显示 foo.bar.baz，而显示 f.b.baz",
+    "fieldFormats.advancedSettings.shortenFieldsTitle": "缩短字段",
+    "fieldFormats.advancedSettings.format.bytesFormat.numeralFormatLinkText": "数值格式",
+    "fieldFormats.advancedSettings.format.bytesFormatText": "“字节”格式的默认{numeralFormatLink}",
+    "fieldFormats.advancedSettings.format.bytesFormatTitle": "字节格式",
+    "fieldFormats.advancedSettings.format.currencyFormat.numeralFormatLinkText": "数值格式",
+    "fieldFormats.advancedSettings.format.currencyFormatText": "“货币”格式的默认{numeralFormatLink}",
+    "fieldFormats.advancedSettings.format.currencyFormatTitle": "货币格式",
+    "fieldFormats.advancedSettings.format.defaultTypeMapText": "要默认用于每个字段类型的格式名称的映射。如果未显式提及字段类型，则将使用{defaultFormat}",
+    "fieldFormats.advancedSettings.format.defaultTypeMapTitle": "字段类型格式名称",
+    "fieldFormats.advancedSettings.format.formattingLocale.numeralLanguageLinkText": "数值语言",
+    "fieldFormats.advancedSettings.format.formattingLocaleText": "{numeralLanguageLink}区域设置",
+    "fieldFormats.advancedSettings.format.formattingLocaleTitle": "格式区域设置",
+    "fieldFormats.advancedSettings.format.numberFormat.numeralFormatLinkText": "数值格式",
+    "fieldFormats.advancedSettings.format.numberFormatText": "“数字”格式的默认{numeralFormatLink}",
+    "fieldFormats.advancedSettings.format.numberFormatTitle": "数字格式",
+    "fieldFormats.advancedSettings.format.percentFormat.numeralFormatLinkText": "数值格式",
+    "fieldFormats.advancedSettings.format.percentFormatText": "“百分比”格式的默认{numeralFormatLink}",
+    "fieldFormats.advancedSettings.format.percentFormatTitle": "百分比格式",
+    "fieldFormats.boolean.title": "布尔型",
+    "fieldFormats.bytes.title": "字节",
+    "fieldFormats.color.title": "颜色",
+    "fieldFormats.date_nanos.title": "日期纳秒",
+    "fieldFormats.date.title": "日期",
+    "fieldFormats.duration.inputFormats.days": "天",
+    "fieldFormats.duration.inputFormats.hours": "小时",
+    "fieldFormats.duration.inputFormats.microseconds": "微秒",
+    "fieldFormats.duration.inputFormats.milliseconds": "毫秒",
+    "fieldFormats.duration.inputFormats.minutes": "分钟",
+    "fieldFormats.duration.inputFormats.months": "月",
+    "fieldFormats.duration.inputFormats.nanoseconds": "纳秒",
+    "fieldFormats.duration.inputFormats.picoseconds": "皮秒",
+    "fieldFormats.duration.inputFormats.seconds": "秒",
+    "fieldFormats.duration.inputFormats.weeks": "周",
+    "fieldFormats.duration.inputFormats.years": "年",
+    "fieldFormats.duration.negativeLabel": "负号",
+    "fieldFormats.duration.outputFormats.asDays": "天",
+    "fieldFormats.duration.outputFormats.asDays.short": "d",
+    "fieldFormats.duration.outputFormats.asHours": "小时",
+    "fieldFormats.duration.outputFormats.asHours.short": "h",
+    "fieldFormats.duration.outputFormats.asMilliseconds": "毫秒",
+    "fieldFormats.duration.outputFormats.asMilliseconds.short": "ms",
+    "fieldFormats.duration.outputFormats.asMinutes": "分钟",
+    "fieldFormats.duration.outputFormats.asMinutes.short": "最小值",
+    "fieldFormats.duration.outputFormats.asMonths": "月",
+    "fieldFormats.duration.outputFormats.asMonths.short": "月",
+    "fieldFormats.duration.outputFormats.asSeconds": "秒",
+    "fieldFormats.duration.outputFormats.asSeconds.short": "s",
+    "fieldFormats.duration.outputFormats.asWeeks": "周",
+    "fieldFormats.duration.outputFormats.asWeeks.short": "w",
+    "fieldFormats.duration.outputFormats.asYears": "年",
+    "fieldFormats.duration.outputFormats.asYears.short": "y",
+    "fieldFormats.duration.outputFormats.humanize.approximate": "可人工读取（近似）",
+    "fieldFormats.duration.outputFormats.humanize.precise": "可人工读取（精确）",
+    "fieldFormats.duration.title": "持续时间",
+    "fieldFormats.histogram.title": "直方图",
+    "fieldFormats.ip.title": "IP 地址",
+    "fieldFormats.number.title": "数字",
+    "fieldFormats.percent.title": "百分比",
+    "fieldFormats.relative_date.title": "相对日期",
+    "fieldFormats.static_lookup.title": "静态查找",
+    "fieldFormats.string.emptyLabel": "（空）",
+    "fieldFormats.string.title": "字符串",
+    "fieldFormats.string.transformOptions.base64": "Base64 解码",
+    "fieldFormats.string.transformOptions.lower": "小写",
+    "fieldFormats.string.transformOptions.none": "- 无 -",
+    "fieldFormats.string.transformOptions.short": "短名",
+    "fieldFormats.string.transformOptions.title": "标题大小写",
+    "fieldFormats.string.transformOptions.upper": "大写",
+    "fieldFormats.string.transformOptions.url": "URL 参数解码",
+    "fieldFormats.truncated_string.title": "已截短字符串",
+    "fieldFormats.url.title": "URL",
+    "fieldFormats.url.types.audio": "音频",
+    "fieldFormats.url.types.img": "图像",
+    "fieldFormats.url.types.link": "链接",
     "flot.time.aprLabel": "四月",
     "flot.time.augLabel": "八月",
     "flot.time.decLabel": "十二月",
@@ -2906,68 +2906,8 @@
     "indexPatternManagement.actions.createButton": "创建字段",
     "indexPatternManagement.actions.deleteButton": "删除",
     "indexPatternManagement.actions.saveButton": "保存字段",
-    "indexPatternManagement.aliasLabel": "别名",
     "indexPatternManagement.createHeader": "创建脚本字段",
-    "indexPatternManagement.createIndexPattern.betaLabel": "公测版",
-    "indexPatternManagement.createIndexPattern.description": "索引模式可以匹配单个源，例如 {single} 或 {multiple} 个数据源、{star}。",
-    "indexPatternManagement.createIndexPattern.documentation": "阅读文档",
-    "indexPatternManagement.createIndexPattern.emptyState.checkDataButton": "检查新数据",
-    "indexPatternManagement.createIndexPattern.emptyState.createAnyway": "部分索引可能已隐藏。仍然尝试{link}。",
-    "indexPatternManagement.createIndexPattern.emptyState.createAnywayLink": "创建索引模式",
-    "indexPatternManagement.createIndexPattern.emptyState.haveData": "假设您已有数据？",
-    "indexPatternManagement.createIndexPattern.emptyState.integrationCardDescription": "从各种源添加数据。",
-    "indexPatternManagement.createIndexPattern.emptyState.integrationCardTitle": "添加集成",
-    "indexPatternManagement.createIndexPattern.emptyState.learnMore": "希望了解详情？",
-    "indexPatternManagement.createIndexPattern.emptyState.noDataTitle": "准备试用 Kibana？首先，您需要数据。",
-    "indexPatternManagement.createIndexPattern.emptyState.readDocs": "阅读文档",
-    "indexPatternManagement.createIndexPattern.emptyState.sampleDataCardDescription": "加载数据集和 Kibana 仪表板。",
-    "indexPatternManagement.createIndexPattern.emptyState.sampleDataCardTitle": "添加样例数据",
-    "indexPatternManagement.createIndexPattern.emptyState.uploadCardDescription": "导入 CSV、NDJSON 或日志文件。",
-    "indexPatternManagement.createIndexPattern.emptyState.uploadCardTitle": "上传文件",
-    "indexPatternManagement.createIndexPattern.includeSystemIndicesToggleSwitchLabel": "包括系统和隐藏索引",
-    "indexPatternManagement.createIndexPattern.loadClustersFailMsg": "无法加载远程集群",
-    "indexPatternManagement.createIndexPattern.loadIndicesFailMsg": "无法加载索引",
-    "indexPatternManagement.createIndexPattern.loadingState.checkingLabel": "正在检查 Elasticsearch 数据",
-    "indexPatternManagement.createIndexPattern.step.indexPattern.allowLabel": "使用星号 ({asterisk}) 匹配多个索引。",
-    "indexPatternManagement.createIndexPattern.step.indexPattern.disallowLabel": "不允许使用空格和字符 {characterList}。",
-    "indexPatternManagement.createIndexPattern.step.indexPatternLabel": "索引模式名称",
-    "indexPatternManagement.createIndexPattern.step.indexPatternPlaceholder": "index-name-*",
-    "indexPatternManagement.createIndexPattern.step.invalidCharactersErrorMessage": "{indexPatternName} 不能包含空格或字符：{characterList}",
-    "indexPatternManagement.createIndexPattern.step.loadingHeader": "正在寻找匹配的索引......",
-    "indexPatternManagement.createIndexPattern.step.nextStepButton": "下一步",
-    "indexPatternManagement.createIndexPattern.step.pagingLabel": "每页行数：{perPage}",
-    "indexPatternManagement.createIndexPattern.step.status.matchAnyLabel.matchAnyDetail": "您的索引模式可以匹配{sourceCount, plural, one {您的 # 个源} other {您的 # 个源中的任何一个} }。",
-    "indexPatternManagement.createIndexPattern.step.status.noSystemIndicesLabel": "没有 Elasticsearch 索引匹配您的模式。",
-    "indexPatternManagement.createIndexPattern.step.status.noSystemIndicesWithPromptLabel": "没有 Elasticsearch 索引匹配您的模式。要查看匹配的系统索引，请切换上面的开关。",
-    "indexPatternManagement.createIndexPattern.step.status.notMatchLabel.allIndicesLabel": "{indicesLength, plural, other {# 个索引} }",
-    "indexPatternManagement.createIndexPattern.step.status.notMatchLabel.notMatchDetail": "输入的索引模式不匹配任何索引。您可以在下面匹配您的 {strongIndices}{indicesLength, plural, one {} other {中任何一个} }。",
-    "indexPatternManagement.createIndexPattern.step.status.partialMatchLabel.partialMatchDetail": "您的索引模式不匹配任何索引，但您的 {strongIndices}{matchedIndicesLength, plural, other {看起来} }类似。",
-    "indexPatternManagement.createIndexPattern.step.status.partialMatchLabel.strongIndicesLabel": "{matchedIndicesLength, plural,one {索引} other {# 个索引} }",
-    "indexPatternManagement.createIndexPattern.step.status.successLabel.successDetail": "您的索引模式匹配 {sourceCount} 个{sourceCount, plural, other {源} }。",
-    "indexPatternManagement.createIndexPattern.step.warningHeader": "已有称作“{query}”的索引模式",
-    "indexPatternManagement.createIndexPattern.stepHeader": "第 1 步（共 2 步）：定义索引模式",
-    "indexPatternManagement.createIndexPattern.stepTime.backButton": "返回",
-    "indexPatternManagement.createIndexPattern.stepTime.createPatternButton": "创建索引模式",
-    "indexPatternManagement.createIndexPattern.stepTime.creatingLabel": "正在创建索引模式……",
-    "indexPatternManagement.createIndexPattern.stepTime.error": "错误",
-    "indexPatternManagement.createIndexPattern.stepTime.field.loadingDropDown": "正在加载……",
-    "indexPatternManagement.createIndexPattern.stepTime.field.noTimeFieldsLabel": "匹配此索引模式的索引不包含任何时间字段。",
-    "indexPatternManagement.createIndexPattern.stepTime.fieldLabel": "时间字段",
-    "indexPatternManagement.createIndexPattern.stepTime.noTimeFieldOptionLabel": "我不想使用时间筛选",
-    "indexPatternManagement.createIndexPattern.stepTime.noTimeFieldsLabel": "匹配此索引模式的索引不包含任何时间字段。",
-    "indexPatternManagement.createIndexPattern.stepTime.options.hideButton": "隐藏高级设置",
-    "indexPatternManagement.createIndexPattern.stepTime.options.patternHeader": "定制索引模式 ID",
-    "indexPatternManagement.createIndexPattern.stepTime.options.patternLabel": "Kibana 将为每个索引模式提供唯一的标识符。如果不想使用此唯一 ID，请输入定制 ID。",
-    "indexPatternManagement.createIndexPattern.stepTime.options.patternPlaceholder": "custom-index-pattern-id",
-    "indexPatternManagement.createIndexPattern.stepTime.options.showButton": "显示高级设置",
-    "indexPatternManagement.createIndexPattern.stepTime.patterAlreadyExists": "自定义索引模式 ID 已存在。",
-    "indexPatternManagement.createIndexPattern.stepTime.refreshButton": "刷新",
-    "indexPatternManagement.createIndexPattern.stepTime.timeDescription": "选择用于全局时间筛选的主要时间字段。",
-    "indexPatternManagement.createIndexPattern.stepTimeHeader": "第 2 步（共 2 步）：配置设置",
-    "indexPatternManagement.createIndexPattern.stepTimeLabel": "为您的 {indexPattern} {indexPatternName} 指定设置。",
-    "indexPatternManagement.createIndexPatternHeader": "创建 {indexPatternName}",
     "indexPatternManagement.customLabel": "定制标签",
-    "indexPatternManagement.dataStreamLabel": "数据流",
     "indexPatternManagement.defaultFormatDropDown": "- 默认值 -",
     "indexPatternManagement.defaultFormatHeader": "格式（默认值：{defaultFormat}）",
     "indexPatternManagement.deleteField.cancelButton": "取消",
@@ -2979,9 +2919,6 @@
     "indexPatternManagement.disabledCallOutHeader": "脚本已禁用",
     "indexPatternManagement.disabledCallOutLabel": "所有内联脚本在 Elasticsearch 中已禁用。必须至少为一种语言启用内联脚本，才能在 Kibana 中使用脚本字段。",
     "indexPatternManagement.editHeader": "编辑 {fieldName}",
-    "indexPatternManagement.editIndexPattern.createIndex.defaultButtonDescription": "对任何数据执行完全聚合",
-    "indexPatternManagement.editIndexPattern.createIndex.defaultButtonText": "标准索引模式",
-    "indexPatternManagement.editIndexPattern.createIndex.defaultTypeName": "索引模式",
     "indexPatternManagement.editIndexPattern.deleteButton": "删除",
     "indexPatternManagement.editIndexPattern.deleteHeader": "删除索引模式？",
     "indexPatternManagement.editIndexPattern.deprecation": "脚本字段已弃用。改用 {runtimeDocs}。",
@@ -3067,31 +3004,12 @@
     "indexPatternManagement.editIndexPattern.timeFilterHeader": "时间字段：“{timeFieldName}”",
     "indexPatternManagement.editIndexPattern.timeFilterLabel.mappingAPILink": "字段映射",
     "indexPatternManagement.editIndexPattern.timeFilterLabel.timeFilterDetail": "查看和编辑 {indexPatternTitle} 中的字段。字段属性，如类型和可搜索性，基于 Elasticsearch 中的 {mappingAPILink}。",
-    "indexPatternManagement.editRollupIndexPattern.createIndex.defaultButtonDescription": "针对汇总数据执行有限聚合",
-    "indexPatternManagement.editRollupIndexPattern.createIndex.defaultButtonText": "汇总/打包索引模式",
-    "indexPatternManagement.editRollupIndexPattern.createIndex.defaultTypeName": "汇总/打包索引模式",
-    "indexPatternManagement.editRollupIndexPattern.createIndex.indexLabel": "汇总/打包",
-    "indexPatternManagement.editRollupIndexPattern.createIndex.noMatchError": "汇总/打包索引模式错误：必须匹配一个汇总/打包索引",
-    "indexPatternManagement.editRollupIndexPattern.createIndex.tooManyMatchesError": "汇总/打包索引模式错误：只能匹配一个汇总/打包索引",
-    "indexPatternManagement.editRollupIndexPattern.createIndex.uncaughtError": "汇总索引模式错误：{error}",
-    "indexPatternManagement.editRollupIndexPattern.rollupPrompt.betaCalloutParagraph1Text": "Kibana 对汇总/打包索引模式的支持处于公测版状态。将这些模式用于已保存搜索、可视化以及仪表板可能会遇到问题。某些高级功能，如 Timelion 和 Machine Learning，不支持这些模式。",
-    "indexPatternManagement.editRollupIndexPattern.rollupPrompt.betaCalloutParagraph2Text": "可以根据一个汇总/打包索引和零个或更多常规索引匹配汇总/打包索引模式。汇总/打包索引模式的指标、字段、时间间隔和聚合有限。汇总/打包索引仅限于具有一个作业配置或多个作业配置兼容的索引。",
-    "indexPatternManagement.emptyIndexPatternPrompt.documentation": "阅读文档",
-    "indexPatternManagement.emptyIndexPatternPrompt.indexPatternExplanation": "Kibana 需要索引模式，以识别您要浏览的索引。索引模式可以指向特定索引（例如昨天的日志数据），或包含日志数据的所有索引。",
-    "indexPatternManagement.emptyIndexPatternPrompt.learnMore": "希望了解详情？",
-    "indexPatternManagement.emptyIndexPatternPrompt.nowCreate": "现在，创建索引模式。",
-    "indexPatternManagement.emptyIndexPatternPrompt.youHaveData": "您在 Elasticsearch 中有数据。",
     "indexPatternManagement.fieldTypeConflict": "字段类型冲突",
     "indexPatternManagement.formatHeader": "格式",
     "indexPatternManagement.formatLabel": "设置格式允许您控制特定值的显示方式。其还会导致值完全更改，并阻止 Discover 中的突出显示起作用。",
-    "indexPatternManagement.frozenLabel": "已冻结",
     "indexPatternManagement.header.runtimeLink": "运行时字段",
-    "indexPatternManagement.indexLabel": "索引",
     "indexPatternManagement.indexNameLabel": "索引名称",
-    "indexPatternManagement.indexPattern.goToPatternButtonLabel": "前往现有模式",
     "indexPatternManagement.indexPattern.sectionsHeader": "索引模式",
-    "indexPatternManagement.indexPattern.titleExistsLabel": "具有标题“{title}”的索引模式已存在。",
-    "indexPatternManagement.indexPatternList.createButton.betaLabel": "公测版",
     "indexPatternManagement.indexPatterns.badge.readOnly.text": "只读",
     "indexPatternManagement.indexPatterns.badge.readOnly.tooltip": "无法保存索引模式",
     "indexPatternManagement.indexPatterns.createBreadcrumb": "创建索引模式",
@@ -5225,11 +5143,6 @@
     "visTypeXy.function.valueAxis.axisParams.help": "值轴参数",
     "visTypeXy.function.valueaxis.help": "生成值轴对象",
     "visTypeXy.function.valueAxis.name.help": "值轴的名称",
-    "visualizations.function.xyDimension.aggType.help": "聚合类型",
-    "visualizations.function.xydimension.help": "生成 xy 维度对象",
-    "visualizations.function.xyDimension.label.help": "标签",
-    "visualizations.function.xyDimension.params.help": "参数",
-    "visualizations.function.xyDimension.visDimension.help": "维度对象配置",
     "visTypeXy.functions.help": "XY 可视化",
     "visTypeXy.histogram.groupTitle": "拆分序列",
     "visTypeXy.histogram.histogramDescription": "在轴上以垂直条形图的形式呈现数据。",
@@ -5268,6 +5181,11 @@
     "visTypeXy.thresholdLine.style.dashedText": "虚线",
     "visTypeXy.thresholdLine.style.dotdashedText": "点虚线",
     "visTypeXy.thresholdLine.style.fullText": "实线",
+    "visualizations.function.xyDimension.aggType.help": "聚合类型",
+    "visualizations.function.xydimension.help": "生成 xy 维度对象",
+    "visualizations.function.xyDimension.label.help": "标签",
+    "visualizations.function.xyDimension.params.help": "参数",
+    "visualizations.function.xyDimension.visDimension.help": "维度对象配置",
     "visualizations.advancedSettings.visualizeEnableLabsText": "允许用户创建、查看和编辑实验性可视化。如果禁用，\n            仅被视为生产就绪的可视化可供用户使用。",
     "visualizations.advancedSettings.visualizeEnableLabsTitle": "启用实验性可视化",
     "visualizations.disabledLabVisualizationLink": "阅读文档",
@@ -5694,8 +5612,6 @@
     "xpack.apm.customLink.empty": "未找到定制链接。设置自己的定制链接，如特定仪表板的链接或外部链接。",
     "xpack.apm.emptyMessage.noDataFoundDescription": "尝试其他时间范围或重置搜索筛选。",
     "xpack.apm.emptyMessage.noDataFoundLabel": "未找到任何数据。",
-    "xpack.apm.enableServiceOverviewExperimentDescription": "为 APM 中的服务启用“概览”选项卡。",
-    "xpack.apm.enableServiceOverviewExperimentName": "APM 服务概览",
     "xpack.apm.error.prompt.body": "有关详情，请查看您的浏览器开发者控制台。",
     "xpack.apm.error.prompt.title": "抱歉，发生错误 :(",
     "xpack.apm.errorCountAlert.name": "错误计数阈值",
@@ -5926,7 +5842,6 @@
     "xpack.apm.serviceMap.invalidLicenseMessage": "要访问服务地图，必须订阅 Elastic 白金级许可。使用该许可证，您将能够可视化整个应用程序堆栈以及 APM 数据。",
     "xpack.apm.serviceMap.noServicesPromptDescription": "我们在当前选择的时间范围和环境内找不到任何要映射的服务。请尝试其他范围或检查选定环境。如果您未使用任何服务，请使用我们的设置说明以开始。",
     "xpack.apm.serviceMap.noServicesPromptTitle": "没有可用服务",
-    "xpack.apm.serviceMap.popoverMetrics.noDataText": "选定的环境没有数据。请尝试切换到其他环境。",
     "xpack.apm.serviceMap.resourceCountLabel": "{count} 项资源",
     "xpack.apm.serviceMap.serviceDetailsButtonText": "服务详情",
     "xpack.apm.serviceMap.subtypePopoverStat": "子类型",
@@ -6767,17 +6682,6 @@
     "xpack.canvas.functions.pointseries.args.yHelpText": "Y 轴上的值。",
     "xpack.canvas.functions.pointseries.unwrappedExpressionErrorMessage": "表达式必须包装在函数中，例如 {fn}",
     "xpack.canvas.functions.pointseriesHelpText": "将 {DATATABLE} 转成点序列模型。当前我们通过寻找 {TINYMATH} 表达式来区分度量和维度。请参阅 {TINYMATH_URL}。如果在参数中输入 {TINYMATH} 表达式，我们将该参数视为度量，否则该参数为维度。维度将进行组合以创建唯一键。然后，这些键使用指定的 {TINYMATH} 函数消除重复的度量",
-    "expressionShape.functions.progress.args.barColorHelpText": "背景条形的颜色。",
-    "expressionShape.functions.progress.args.barWeightHelpText": "背景条形的粗细。",
-    "expressionShape.functions.progress.args.fontHelpText": "标签的 {CSS} 字体属性。例如 {FONT_FAMILY} 或 {FONT_WEIGHT}。",
-    "expressionShape.functions.progress.args.labelHelpText": "要显示或隐藏标签，请使用 {BOOLEAN_TRUE} 或 {BOOLEAN_FALSE}。或者，提供字符串以显示为标签。",
-    "expressionShape.functions.progress.args.maxHelpText": "进度元素的最大值。",
-    "expressionShape.functions.progress.args.shapeHelpText": "选择 {list} 或 {end}。",
-    "expressionShape.functions.progress.args.valueColorHelpText": "进度条的颜色。",
-    "expressionShape.functions.progress.args.valueWeightHelpText": "进度条的粗细。",
-    "expressionShape.functions.progress.invalidMaxValueErrorMessage": "无效的 {arg} 值：“{max, number}”。“{arg}”必须大于 0",
-    "expressionShape.functions.progress.invalidValueErrorMessage": "无效的值：“{value, number}”。值必须介于 0 和 {max, number} 之间",
-    "expressionShape.functions.progressHelpText": "配置进度元素。",
     "xpack.canvas.functions.render.args.asHelpText": "要渲染的元素类型。您可能需要专门的函数，例如 {plotFn} 或 {shapeFn}。",
     "xpack.canvas.functions.render.args.containerStyleHelpText": "容器的样式，包括背景、边框和透明度。",
     "xpack.canvas.functions.render.args.cssHelpText": "要限定于元素的任何定制 {CSS} 块。",
@@ -6966,8 +6870,6 @@
     "xpack.canvas.renderer.pie.helpDescription": "根据您的数据呈现饼图",
     "xpack.canvas.renderer.plot.displayName": "坐标图",
     "xpack.canvas.renderer.plot.helpDescription": "根据您的数据呈现 XY 坐标图",
-    "expressionShape.renderer.progress.displayName": "进度指示",
-    "expressionShape.renderer.progress.helpDescription": "呈现显示元素百分比的进度指示",
     "xpack.canvas.renderer.table.displayName": "数据表",
     "xpack.canvas.renderer.table.helpDescription": "将表格数据呈现为 {HTML}",
     "xpack.canvas.renderer.text.displayName": "纯文本",
@@ -7459,6 +7361,27 @@
     "xpack.canvas.workpadTemplates.table.descriptionColumnTitle": "描述",
     "xpack.canvas.workpadTemplates.table.nameColumnTitle": "模板名称",
     "xpack.canvas.workpadTemplates.table.tagsColumnTitle": "标签",
+    "expressionShape.functions.progress.args.barColorHelpText": "背景条形的颜色。",
+    "expressionShape.functions.progress.args.barWeightHelpText": "背景条形的粗细。",
+    "expressionShape.functions.progress.args.fontHelpText": "标签的 {CSS} 字体属性。例如 {FONT_FAMILY} 或 {FONT_WEIGHT}。",
+    "expressionShape.functions.progress.args.labelHelpText": "要显示或隐藏标签，请使用 {BOOLEAN_TRUE} 或 {BOOLEAN_FALSE}。或者，提供字符串以显示为标签。",
+    "expressionShape.functions.progress.args.maxHelpText": "进度元素的最大值。",
+    "expressionShape.functions.progress.args.shapeHelpText": "选择 {list} 或 {end}。",
+    "expressionShape.functions.progress.args.valueColorHelpText": "进度条的颜色。",
+    "expressionShape.functions.progress.args.valueWeightHelpText": "进度条的粗细。",
+    "expressionShape.functions.progress.invalidMaxValueErrorMessage": "无效的 {arg} 值：“{max, number}”。“{arg}”必须大于 0",
+    "expressionShape.functions.progress.invalidValueErrorMessage": "无效的值：“{value, number}”。值必须介于 0 和 {max, number} 之间",
+    "expressionShape.functions.progressHelpText": "配置进度元素。",
+    "expressionShape.renderer.progress.displayName": "进度指示",
+    "expressionShape.renderer.progress.helpDescription": "呈现显示元素百分比的进度指示",
+    "expressionShape.renderer.shape.displayName": "形状",
+    "expressionShape.renderer.shape.helpDescription": "呈现基本形状",
+    "expressionShape.functions.shape.args.borderHelpText": "形状轮廓边框的 {SVG} 颜色。",
+    "expressionShape.functions.shape.args.borderWidthHelpText": "边框的粗细。",
+    "expressionShape.functions.shape.args.fillHelpText": "填充形状的 {SVG} 颜色。",
+    "expressionShape.functions.shape.args.maintainAspectHelpText": "维持形状的原始纵横比？",
+    "expressionShape.functions.shape.args.shapeHelpText": "选取形状。",
+    "expressionShape.functions.shapeHelpText": "创建形状。",
     "expressionRepeatImage.error.repeatImage.missingMaxArgument": "如果提供 {emptyImageArgument}，则必须设置 {maxArgument}",
     "expressionRepeatImage.functions.repeatImage.args.emptyImageHelpText": "使用此图像填充元素的 {CONTEXT} 和 {maxArg} 参数之间的差距。以 {BASE64} 数据 {URL} 的形式提供图像资产或传入子表达式。",
     "expressionRepeatImage.functions.repeatImage.args.imageHelpText": "要重复的图像。以 {BASE64} 数据 {URL} 的形式提供图像资产或传入子表达式。",
@@ -7487,14 +7410,6 @@
     "expressionRevealImage.functions.revealImage.args.originHelpText": "要开始图像填充的位置。例如 {list} 或 {end}。",
     "expressionRevealImage.functions.revealImage.invalidPercentErrorMessage": "无效值：“{percent}”。百分比必须介于 0 和 1 之间",
     "expressionRevealImage.functions.revealImageHelpText": "配置图像显示元素。",
-    "expressionShape.renderer.shape.displayName": "形状",
-    "expressionShape.renderer.shape.helpDescription": "呈现基本形状",
-    "expressionShape.functions.shape.args.borderHelpText": "形状轮廓边框的 {SVG} 颜色。",
-    "expressionShape.functions.shape.args.borderWidthHelpText": "边框的粗细。",
-    "expressionShape.functions.shape.args.fillHelpText": "填充形状的 {SVG} 颜色。",
-    "expressionShape.functions.shape.args.maintainAspectHelpText": "维持形状的原始纵横比？",
-    "expressionShape.functions.shape.args.shapeHelpText": "选取形状。",
-    "expressionShape.functions.shapeHelpText": "创建形状。",
     "expressionError.errorComponent.description": "表达式失败，并显示消息：",
     "expressionError.errorComponent.title": "哎哟！表达式失败",
     "expressionError.renderer.debug.displayName": "故障排查",
@@ -11947,7 +11862,6 @@
     "xpack.indexLifecycleMgmt.nodeAttrDetails.idField": "ID",
     "xpack.indexLifecycleMgmt.nodeAttrDetails.nameField": "名称",
     "xpack.indexLifecycleMgmt.nodeAttrDetails.title": "包含属性 {selectedNodeAttrs} 的节点",
-    "xpack.indexLifecycleMgmt.noMatch.noPolicicesDescription": "没有要显示的策略",
     "xpack.indexLifecycleMgmt.numberOfReplicas.formRowTitle": "副本分片",
     "xpack.indexLifecycleMgmt.optionalMessage": " （可选）",
     "xpack.indexLifecycleMgmt.phaseErrorIcon.tooltipDescription": "此阶段包含错误。",
@@ -11959,7 +11873,6 @@
     "xpack.indexLifecycleMgmt.policyJsonFlyout.unnamedTitle": "请求",
     "xpack.indexLifecycleMgmt.policyJsonFlyout.validationErrorCallout.body": "要查看此策略的 JSON，请解决所有验证错误。",
     "xpack.indexLifecycleMgmt.policyJsonFlyout.validationErrorCallout.title": "无效策略",
-    "xpack.indexLifecycleMgmt.policyTable.actionsButtonText": "操作",
     "xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.cancelButton": "取消",
     "xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.chooseTemplateLabel": "索引模板",
     "xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.chooseTemplateMessage": "选择索引模板",
@@ -11974,8 +11887,6 @@
     "xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.templateHasPolicyWarningTitle": "模板已有策略",
     "xpack.indexLifecycleMgmt.policyTable.addLifecyclePolicyToTemplateConfirmModal.title": "将策略 “{name}” 添加到索引模板",
     "xpack.indexLifecycleMgmt.policyTable.addPolicyToTemplateButtonText": "将策略添加到索引模板",
-    "xpack.indexLifecycleMgmt.policyTable.captionText": "以下是包含 {count, plural, other {# 行}}（总计 {total} 行）的索引生命周期策略表。",
-    "xpack.indexLifecycleMgmt.policyTable.deletePolicyButtonDisabledTooltip": "您无法删除索引正在使用的策略",
     "xpack.indexLifecycleMgmt.policyTable.deletePolicyButtonText": "删除策略",
     "xpack.indexLifecycleMgmt.policyTable.emptyPrompt.createButtonLabel": "创建策略",
     "xpack.indexLifecycleMgmt.policyTable.emptyPromptDescription": " 索引生命周期策略帮助您管理变旧的索引。",
@@ -11983,15 +11894,11 @@
     "xpack.indexLifecycleMgmt.policyTable.headers.linkedIndicesHeader": "已链接索引",
     "xpack.indexLifecycleMgmt.policyTable.headers.modifiedDateHeader": "上次修改日期",
     "xpack.indexLifecycleMgmt.policyTable.headers.nameHeader": "名称",
-    "xpack.indexLifecycleMgmt.policyTable.headers.versionHeader": "版本",
     "xpack.indexLifecycleMgmt.policyTable.policiesLoading": "正在加载策略……",
     "xpack.indexLifecycleMgmt.policyTable.policiesLoadingFailedTitle": "无法加载现有生命周期策略",
     "xpack.indexLifecycleMgmt.policyTable.policiesReloadButton": "重试",
-    "xpack.indexLifecycleMgmt.policyTable.policyActionsMenu.panelTitle": "策略选项",
     "xpack.indexLifecycleMgmt.policyTable.sectionDescription": "管理变旧的索引。 附加策略以自动化何时以及如何在索引整个生命周期中变迁索引。",
     "xpack.indexLifecycleMgmt.policyTable.sectionHeading": "索引生命周期策略",
-    "xpack.indexLifecycleMgmt.policyTable.systempoliciesSearchInputAriaLabel": "搜索策略",
-    "xpack.indexLifecycleMgmt.policyTable.systempoliciesSearchInputPlaceholder": "搜索",
     "xpack.indexLifecycleMgmt.policyTable.viewIndicesButtonText": "查看链接到策略的索引",
     "xpack.indexLifecycleMgmt.readonlyFieldLabel": "使索引只读",
     "xpack.indexLifecycleMgmt.removeIndexLifecycleActionButtonLabel": "删除生命周期策略",
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.test.tsx
index 5d4237e2176a06..d198c82366fbfc 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.test.tsx
@@ -536,6 +536,11 @@ describe('disable button', () => {
     });
     expect(disableAlert).toHaveBeenCalled();
 
+    await act(async () => {
+      await nextTick();
+      wrapper.update();
+    });
+
     // Enable the alert
     await act(async () => {
       wrapper.find('[data-test-subj="enableSwitch"] .euiSwitch__button').first().simulate('click');
@@ -546,6 +551,77 @@ describe('disable button', () => {
     // Ensure error banner is back
     expect(wrapper.find('[data-test-subj="dismiss-execution-error"]').length).toBeGreaterThan(0);
   });
+
+  it('should show the loading spinner when the rule enabled switch was clicked and the server responded with some delay', async () => {
+    const alert = mockAlert({
+      enabled: true,
+      executionStatus: {
+        status: 'error',
+        lastExecutionDate: new Date('2020-08-20T19:23:38Z'),
+        error: {
+          reason: AlertExecutionStatusErrorReasons.Execute,
+          message: 'Fail',
+        },
+      },
+    });
+
+    const alertType: AlertType = {
+      id: '.noop',
+      name: 'No Op',
+      actionGroups: [{ id: 'default', name: 'Default' }],
+      recoveryActionGroup,
+      actionVariables: { context: [], state: [], params: [] },
+      defaultActionGroupId: 'default',
+      producer: ALERTS_FEATURE_ID,
+      authorizedConsumers,
+      minimumLicenseRequired: 'basic',
+      enabledInLicense: true,
+    };
+
+    const disableAlert = jest.fn(async () => {
+      await new Promise((resolve) => setTimeout(resolve, 6000));
+    });
+    const enableAlert = jest.fn();
+    const wrapper = mountWithIntl(
+      <AlertDetails
+        alert={alert}
+        alertType={alertType}
+        actionTypes={[]}
+        {...mockAlertApis}
+        disableAlert={disableAlert}
+        enableAlert={enableAlert}
+      />
+    );
+
+    await act(async () => {
+      await nextTick();
+      wrapper.update();
+    });
+
+    // Dismiss the error banner
+    await act(async () => {
+      wrapper.find('[data-test-subj="dismiss-execution-error"]').first().simulate('click');
+      await nextTick();
+    });
+
+    // Disable the alert
+    await act(async () => {
+      wrapper.find('[data-test-subj="enableSwitch"] .euiSwitch__button').first().simulate('click');
+      await nextTick();
+    });
+    expect(disableAlert).toHaveBeenCalled();
+
+    await act(async () => {
+      await nextTick();
+      wrapper.update();
+    });
+
+    // Enable the alert
+    await act(async () => {
+      expect(wrapper.find('[data-test-subj="enableSpinner"]').length).toBeGreaterThan(0);
+      await nextTick();
+    });
+  });
 });
 
 describe('mute button', () => {
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.tsx
index 1328ba6479f687..2558993a13fe61 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.tsx
@@ -21,6 +21,7 @@ import {
   EuiSpacer,
   EuiButtonEmpty,
   EuiButton,
+  EuiLoadingSpinner,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { AlertExecutionStatusErrorReasons } from '../../../../../../alerting/common';
@@ -99,6 +100,8 @@ export const AlertDetails: React.FunctionComponent<AlertDetailsProps> = ({
   const alertActions = alert.actions;
   const uniqueActions = Array.from(new Set(alertActions.map((item: any) => item.actionTypeId)));
   const [isEnabled, setIsEnabled] = useState<boolean>(alert.enabled);
+  const [isEnabledUpdating, setIsEnabledUpdating] = useState<boolean>(false);
+  const [isMutedUpdating, setIsMutedUpdating] = useState<boolean>(false);
   const [isMuted, setIsMuted] = useState<boolean>(alert.muteAll);
   const [editFlyoutVisible, setEditFlyoutVisibility] = useState<boolean>(false);
   const [dissmissAlertErrors, setDissmissAlertErrors] = useState<boolean>(false);
@@ -218,54 +221,92 @@ export const AlertDetails: React.FunctionComponent<AlertDetailsProps> = ({
             <EuiSpacer />
             <EuiFlexGroup justifyContent="flexEnd" wrap responsive={false} gutterSize="m">
               <EuiFlexItem grow={false}>
-                <EuiSwitch
-                  name="enable"
-                  disabled={!canSaveAlert || !alertType.enabledInLicense}
-                  checked={isEnabled}
-                  data-test-subj="enableSwitch"
-                  onChange={async () => {
-                    if (isEnabled) {
-                      setIsEnabled(false);
-                      await disableAlert(alert);
-                      // Reset dismiss if previously clicked
-                      setDissmissAlertErrors(false);
-                    } else {
-                      setIsEnabled(true);
-                      await enableAlert(alert);
+                {isEnabledUpdating ? (
+                  <EuiFlexGroup>
+                    <EuiFlexItem>
+                      <EuiLoadingSpinner data-test-subj="enableSpinner" size="m" />
+                    </EuiFlexItem>
+
+                    <EuiFlexItem>
+                      <EuiText size="s">
+                        <FormattedMessage
+                          id="xpack.triggersActionsUI.sections.alertDetails.collapsedItemActons.enableLoadingTitle"
+                          defaultMessage="Enable"
+                        />
+                      </EuiText>
+                    </EuiFlexItem>
+                  </EuiFlexGroup>
+                ) : (
+                  <EuiSwitch
+                    name="enable"
+                    disabled={!canSaveAlert || !alertType.enabledInLicense}
+                    checked={isEnabled}
+                    data-test-subj="enableSwitch"
+                    onChange={async () => {
+                      setIsEnabledUpdating(true);
+                      if (isEnabled) {
+                        setIsEnabled(false);
+                        await disableAlert(alert);
+                        // Reset dismiss if previously clicked
+                        setDissmissAlertErrors(false);
+                      } else {
+                        setIsEnabled(true);
+                        await enableAlert(alert);
+                      }
+                      requestRefresh();
+                      setIsEnabledUpdating(false);
+                    }}
+                    label={
+                      <FormattedMessage
+                        id="xpack.triggersActionsUI.sections.alertDetails.collapsedItemActons.enableTitle"
+                        defaultMessage="Enable"
+                      />
                     }
-                    requestRefresh();
-                  }}
-                  label={
-                    <FormattedMessage
-                      id="xpack.triggersActionsUI.sections.alertDetails.collapsedItemActons.enableTitle"
-                      defaultMessage="Enable"
-                    />
-                  }
-                />
+                  />
+                )}
               </EuiFlexItem>
               <EuiFlexItem grow={false}>
-                <EuiSwitch
-                  name="mute"
-                  checked={isMuted}
-                  disabled={!canSaveAlert || !isEnabled || !alertType.enabledInLicense}
-                  data-test-subj="muteSwitch"
-                  onChange={async () => {
-                    if (isMuted) {
-                      setIsMuted(false);
-                      await unmuteAlert(alert);
-                    } else {
-                      setIsMuted(true);
-                      await muteAlert(alert);
+                {isMutedUpdating ? (
+                  <EuiFlexGroup>
+                    <EuiFlexItem>
+                      <EuiLoadingSpinner size="m" />
+                    </EuiFlexItem>
+
+                    <EuiFlexItem>
+                      <EuiText size="s">
+                        <FormattedMessage
+                          id="xpack.triggersActionsUI.sections.alertDetails.collapsedItemActons.muteLoadingTitle"
+                          defaultMessage="Mute"
+                        />
+                      </EuiText>
+                    </EuiFlexItem>
+                  </EuiFlexGroup>
+                ) : (
+                  <EuiSwitch
+                    name="mute"
+                    checked={isMuted}
+                    disabled={!canSaveAlert || !isEnabled || !alertType.enabledInLicense}
+                    data-test-subj="muteSwitch"
+                    onChange={async () => {
+                      setIsMutedUpdating(true);
+                      if (isMuted) {
+                        setIsMuted(false);
+                        await unmuteAlert(alert);
+                      } else {
+                        setIsMuted(true);
+                        await muteAlert(alert);
+                      }
+                      requestRefresh();
+                      setIsMutedUpdating(false);
+                    }}
+                    label={
+                      <FormattedMessage
+                        id="xpack.triggersActionsUI.sections.alertDetails.collapsedItemActons.muteTitle"
+                        defaultMessage="Mute"
+                      />
                     }
-                    requestRefresh();
-                  }}
-                  label={
-                    <FormattedMessage
-                      id="xpack.triggersActionsUI.sections.alertDetails.collapsedItemActons.muteTitle"
-                      defaultMessage="Mute"
-                    />
-                  }
-                />
+                  />
+                )}
               </EuiFlexItem>
             </EuiFlexGroup>
           </EuiFlexItem>
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances.tsx
index 29290af0d02852..1583cb188f1c18 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances.tsx
@@ -8,7 +8,7 @@
 import React, { useState } from 'react';
 import moment, { Duration } from 'moment';
 import { i18n } from '@kbn/i18n';
-import { EuiBasicTable, EuiHealth, EuiSpacer, EuiSwitch, EuiToolTip } from '@elastic/eui';
+import { EuiBasicTable, EuiHealth, EuiSpacer, EuiToolTip } from '@elastic/eui';
 // @ts-ignore
 import { RIGHT_ALIGNMENT, CENTER_ALIGNMENT } from '@elastic/eui/lib/services';
 import { padStart, chunk } from 'lodash';
@@ -26,6 +26,7 @@ import {
 } from '../../common/components/with_bulk_alert_api_operations';
 import { DEFAULT_SEARCH_PAGE_SIZE } from '../../../constants';
 import './alert_instances.scss';
+import { RuleMutedSwitch } from './rule_muted_switch';
 
 type AlertInstancesProps = {
   alert: Alert;
@@ -112,17 +113,11 @@ export const alertInstancesTableColumns = (
     ),
     render: (alertInstance: AlertInstanceListItem) => {
       return (
-        <>
-          <EuiSwitch
-            label="mute"
-            showLabel={false}
-            compressed={true}
-            checked={alertInstance.isMuted}
-            disabled={readOnly}
-            data-test-subj={`muteAlertInstanceButton_${alertInstance.instance}`}
-            onChange={() => onMuteAction(alertInstance)}
-          />
-        </>
+        <RuleMutedSwitch
+          disabled={readOnly}
+          onMuteAction={async () => await onMuteAction(alertInstance)}
+          alertInstance={alertInstance}
+        />
       );
     },
     sortable: false,
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/rule_muted_switch.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/rule_muted_switch.tsx
new file mode 100644
index 00000000000000..bee0c8aef706d0
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/rule_muted_switch.tsx
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useState } from 'react';
+import { EuiSwitch, EuiLoadingSpinner } from '@elastic/eui';
+
+import { AlertInstanceListItem } from './alert_instances';
+
+interface ComponentOpts {
+  alertInstance: AlertInstanceListItem;
+  onMuteAction: (instance: AlertInstanceListItem) => Promise<void>;
+  disabled: boolean;
+}
+
+export const RuleMutedSwitch: React.FunctionComponent<ComponentOpts> = ({
+  alertInstance,
+  onMuteAction,
+  disabled,
+}: ComponentOpts) => {
+  const [isMuted, setIsMuted] = useState<boolean>(alertInstance?.isMuted);
+  const [isUpdating, setIsUpdating] = useState<boolean>(false);
+
+  return isUpdating ? (
+    <EuiLoadingSpinner size="m" />
+  ) : (
+    <EuiSwitch
+      name="mute"
+      disabled={disabled}
+      compressed={true}
+      checked={isMuted}
+      onChange={async () => {
+        setIsUpdating(true);
+        await onMuteAction(alertInstance);
+        setIsMuted(!isMuted);
+        setIsUpdating(false);
+      }}
+      data-test-subj={`muteAlertInstanceButton_${alertInstance.instance}`}
+      showLabel={false}
+      label="mute"
+    />
+  );
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/rule_enabled_switch.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/rule_enabled_switch.tsx
index c031f189ffa4d0..49871549d27344 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/rule_enabled_switch.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/rule_enabled_switch.tsx
@@ -5,9 +5,8 @@
  * 2.0.
  */
 
-import { asyncScheduler } from 'rxjs';
-import React, { useEffect, useState } from 'react';
-import { EuiSwitch } from '@elastic/eui';
+import React, { useState, useEffect } from 'react';
+import { EuiSwitch, EuiLoadingSpinner } from '@elastic/eui';
 
 import { Alert, AlertTableItem } from '../../../../types';
 
@@ -28,8 +27,11 @@ export const RuleEnabledSwitch: React.FunctionComponent<ComponentOpts> = ({
   useEffect(() => {
     setIsEnabled(item.enabled);
   }, [item.enabled]);
+  const [isUpdating, setIsUpdating] = useState<boolean>(false);
 
-  return (
+  return isUpdating ? (
+    <EuiLoadingSpinner data-test-subj="enableSpinner" size="m" />
+  ) : (
     <EuiSwitch
       name="enable"
       disabled={!item.isEditable || !item.enabledInLicense}
@@ -37,16 +39,16 @@ export const RuleEnabledSwitch: React.FunctionComponent<ComponentOpts> = ({
       checked={isEnabled}
       data-test-subj="enableSwitch"
       onChange={async () => {
-        const enabled = isEnabled;
-        asyncScheduler.schedule(async () => {
-          if (enabled) {
-            await disableAlert({ ...item, enabled });
-          } else {
-            await enableAlert({ ...item, enabled });
-          }
-          onAlertChanged();
-        }, 10);
+        setIsUpdating(true);
+        const enabled = item.enabled;
+        if (enabled) {
+          await disableAlert({ ...item, enabled });
+        } else {
+          await enableAlert({ ...item, enabled });
+        }
         setIsEnabled(!isEnabled);
+        setIsUpdating(false);
+        onAlertChanged();
       }}
       label=""
     />
diff --git a/x-pack/plugins/uptime/public/components/common/charts/__snapshots__/donut_chart.test.tsx.snap b/x-pack/plugins/uptime/public/components/common/charts/__snapshots__/donut_chart.test.tsx.snap
index 016714d0281716..1b7be5dc261b8a 100644
--- a/x-pack/plugins/uptime/public/components/common/charts/__snapshots__/donut_chart.test.tsx.snap
+++ b/x-pack/plugins/uptime/public/components/common/charts/__snapshots__/donut_chart.test.tsx.snap
@@ -198,6 +198,9 @@ exports[`DonutChart component passes correct props without errors for valid prop
           },
           "legend": Object {
             "horizontalHeight": 64,
+            "labelOptions": Object {
+              "maxLines": 1,
+            },
             "margin": 0,
             "spacingBuffer": 10,
             "verticalWidth": 200,
diff --git a/x-pack/plugins/watcher/kibana.json b/x-pack/plugins/watcher/kibana.json
index b9df25d80e62e1..84fe2b509b2637 100644
--- a/x-pack/plugins/watcher/kibana.json
+++ b/x-pack/plugins/watcher/kibana.json
@@ -15,6 +15,7 @@
   "ui": true,
   "requiredBundles": [
     "esUiShared",
-    "kibanaReact"
+    "kibanaReact",
+    "fieldFormats"
   ]
 }
diff --git a/x-pack/plugins/watcher/public/legacy/time_buckets.js b/x-pack/plugins/watcher/public/legacy/time_buckets.js
index a65e069bb208ba..173369152f8e0d 100644
--- a/x-pack/plugins/watcher/public/legacy/time_buckets.js
+++ b/x-pack/plugins/watcher/public/legacy/time_buckets.js
@@ -7,7 +7,8 @@
 
 import _ from 'lodash';
 import moment from 'moment';
-import { search, FIELD_FORMAT_IDS, UI_SETTINGS } from '../../../../../src/plugins/data/public';
+import { search, UI_SETTINGS } from '../../../../../src/plugins/data/public';
+import { FIELD_FORMAT_IDS } from '../../../../../src/plugins/field_formats/common';
 import { calcAutoIntervalLessThan, calcAutoIntervalNear } from './calc_auto_interval';
 import {
   convertDurationToNormalizedEsInterval,
diff --git a/x-pack/test/accessibility/apps/index_lifecycle_management.ts b/x-pack/test/accessibility/apps/index_lifecycle_management.ts
index dcd690607c64a5..da56cfd702abf9 100644
--- a/x-pack/test/accessibility/apps/index_lifecycle_management.ts
+++ b/x-pack/test/accessibility/apps/index_lifecycle_management.ts
@@ -57,13 +57,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     throw new Error(`Could not find ${policyName} in policy table`);
   };
 
-  const clickPolicyActionsButton = async (policyName: string) => {
-    const actionsCell = await testSubjects.find(`policyTableCell-actions-${policyName}`);
-    const actionsButton = await actionsCell.findByTestSubject('policyActionsContextMenuButton');
-
-    await actionsButton.click();
-  };
-
   describe('Index Lifecycle Management', async () => {
     before(async () => {
       await esClient.ilm.putLifecycle({ policy: POLICY_NAME, body: POLICY_ALL_PHASES });
@@ -149,34 +142,26 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     });
 
     it('Add policy to index template modal', async () => {
-      await clickPolicyActionsButton(POLICY_NAME);
+      const policyRow = await testSubjects.find(`policyTableRow-${POLICY_NAME}`);
+      const addPolicyButton = await policyRow.findByTestSubject('addPolicyToTemplate');
 
-      const buttonSelector = 'addPolicyToTemplate';
-
-      await retry.waitFor('ILM add policy to index template button', async () => {
-        return testSubjects.isDisplayed(buttonSelector);
-      });
-      await testSubjects.click(buttonSelector);
+      await addPolicyButton.click();
 
       await retry.waitFor('ILM add policy to index template modal to be present', async () => {
-        return testSubjects.isDisplayed('confirmModalTitleText');
+        return testSubjects.isDisplayed('addPolicyToTemplateModal');
       });
 
       await a11y.testAppSnapshot();
     });
 
     it('Delete policy modal', async () => {
-      await clickPolicyActionsButton(POLICY_NAME);
-
-      const buttonSelector = 'deletePolicy';
+      const policyRow = await testSubjects.find(`policyTableRow-${POLICY_NAME}`);
+      const deleteButton = await policyRow.findByTestSubject('deletePolicy');
 
-      await retry.waitFor('ILM delete policy button', async () => {
-        return testSubjects.isDisplayed(buttonSelector);
-      });
-      await testSubjects.click(buttonSelector);
+      await deleteButton.click();
 
       await retry.waitFor('ILM delete policy modal to be present', async () => {
-        return testSubjects.isDisplayed('confirmModalTitleText');
+        return testSubjects.isDisplayed('deletePolicyModal');
       });
 
       await a11y.testAppSnapshot();
diff --git a/x-pack/test/apm_api_integration/tests/service_maps/service_maps.ts b/x-pack/test/apm_api_integration/tests/service_maps/service_maps.ts
index b043efe05b5235..0461ac8e4821a8 100644
--- a/x-pack/test/apm_api_integration/tests/service_maps/service_maps.ts
+++ b/x-pack/test/apm_api_integration/tests/service_maps/service_maps.ts
@@ -55,11 +55,39 @@ export default function serviceMapsApiTests({ getService }: FtrProviderContext)
 
         expect(response.status).to.be(200);
 
-        expect(response.body.avgCpuUsage).to.be(null);
-        expect(response.body.avgErrorRate).to.be(null);
-        expect(response.body.avgMemoryUsage).to.be(null);
-        expect(response.body.transactionStats.avgRequestsPerMinute).to.be(null);
-        expect(response.body.transactionStats.avgTransactionDuration).to.be(null);
+        expectSnapshot(response.body).toMatchInline(`
+          Object {
+            "avgCpuUsage": null,
+            "avgErrorRate": null,
+            "avgMemoryUsage": null,
+            "transactionStats": Object {
+              "avgRequestsPerMinute": null,
+              "avgTransactionDuration": null,
+            },
+          }
+        `);
+      });
+    });
+
+    describe('/api/apm/service-map/backend/{backendName}', () => {
+      it('returns an object with nulls', async () => {
+        const q = querystring.stringify({
+          start: metadata.start,
+          end: metadata.end,
+        });
+        const response = await supertest.get(`/api/apm/service-map/backend/postgres?${q}`);
+
+        expect(response.status).to.be(200);
+
+        expectSnapshot(response.body).toMatchInline(`
+          Object {
+            "avgErrorRate": null,
+            "transactionStats": Object {
+              "avgRequestsPerMinute": null,
+              "avgTransactionDuration": null,
+            },
+          }
+        `);
       });
     });
   });
@@ -243,5 +271,51 @@ export default function serviceMapsApiTests({ getService }: FtrProviderContext)
         });
       });
     });
+
+    describe('/api/apm/service-map/service/{serviceName}', () => {
+      it('returns an object with data', async () => {
+        const q = querystring.stringify({
+          start: metadata.start,
+          end: metadata.end,
+        });
+        const response = await supertest.get(`/api/apm/service-map/service/opbeans-node?${q}`);
+
+        expect(response.status).to.be(200);
+
+        expectSnapshot(response.body).toMatchInline(`
+          Object {
+            "avgCpuUsage": 0.240216666666667,
+            "avgErrorRate": 0,
+            "avgMemoryUsage": 0.202572668763642,
+            "transactionStats": Object {
+              "avgRequestsPerMinute": 5.2,
+              "avgTransactionDuration": 53906.6603773585,
+            },
+          }
+        `);
+      });
+    });
+
+    describe('/api/apm/service-map/backend/{backendName}', () => {
+      it('returns an object with data', async () => {
+        const q = querystring.stringify({
+          start: metadata.start,
+          end: metadata.end,
+        });
+        const response = await supertest.get(`/api/apm/service-map/backend/postgresql?${q}`);
+
+        expect(response.status).to.be(200);
+
+        expectSnapshot(response.body).toMatchInline(`
+          Object {
+            "avgErrorRate": 0,
+            "transactionStats": Object {
+              "avgRequestsPerMinute": 82.9666666666667,
+              "avgTransactionDuration": 18307.583366814,
+            },
+          }
+        `);
+      });
+    });
   });
 }
diff --git a/x-pack/test/apm_api_integration/tests/service_overview/dependencies/index.ts b/x-pack/test/apm_api_integration/tests/service_overview/dependencies/index.ts
index 4f10ee6ff6bd8f..942378477f04cb 100644
--- a/x-pack/test/apm_api_integration/tests/service_overview/dependencies/index.ts
+++ b/x-pack/test/apm_api_integration/tests/service_overview/dependencies/index.ts
@@ -357,6 +357,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
             'errorRate.timeseries',
             'throughput.timeseries',
             'latency.timeseries',
+            'totalTime.timeseries',
           ])
         ).toMatchInline(`
           Object {
@@ -370,6 +371,9 @@ export default function ApiTest({ getService }: FtrProviderContext) {
             "throughput": Object {
               "value": 1.83333333333333,
             },
+            "totalTime": Object {
+              "value": 61439716,
+            },
           }
         `);
       });
@@ -467,8 +471,6 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           response.body.serviceDependencies.map((item) => ({
             name: getName(item.location),
             impact: item.currentStats.impact,
-            latency: item.currentStats.latency.value,
-            throughput: item.currentStats.throughput.value,
           })),
           'name'
         );
@@ -477,27 +479,50 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           Array [
             Object {
               "impact": 0,
-              "latency": 9496.32291666667,
               "name": "elasticsearch",
-              "throughput": 3.2,
             },
             Object {
               "impact": 100,
-              "latency": 1117085.74545455,
               "name": "opbeans-dotnet",
-              "throughput": 1.83333333333333,
             },
             Object {
               "impact": 71.0403531954737,
-              "latency": 27826.9968314322,
               "name": "postgresql",
-              "throughput": 52.6,
             },
             Object {
               "impact": 1.41447268043525,
-              "latency": 1468.27242524917,
               "name": "redis",
-              "throughput": 40.1333333333333,
+            },
+          ]
+        `);
+      });
+
+      it('returns the right totalTime values', () => {
+        const totalTimeValues = sortBy(
+          response.body.serviceDependencies.map((item) => ({
+            name: getName(item.location),
+            totalTime: item.currentStats.totalTime.value,
+          })),
+          'name'
+        );
+
+        expectSnapshot(totalTimeValues).toMatchInline(`
+          Array [
+            Object {
+              "name": "elasticsearch",
+              "totalTime": 911647,
+            },
+            Object {
+              "name": "opbeans-dotnet",
+              "totalTime": 61439716,
+            },
+            Object {
+              "name": "postgresql",
+              "totalTime": 43911001,
+            },
+            Object {
+              "name": "redis",
+              "totalTime": 1767800,
             },
           ]
         `);
diff --git a/x-pack/test/apm_api_integration/tests/services/error_groups_main_statistics.ts b/x-pack/test/apm_api_integration/tests/services/error_groups_main_statistics.ts
index 3b91cb947c7f76..3f6edf1ccccfa1 100644
--- a/x-pack/test/apm_api_integration/tests/services/error_groups_main_statistics.ts
+++ b/x-pack/test/apm_api_integration/tests/services/error_groups_main_statistics.ts
@@ -108,7 +108,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         expectSnapshot(firstItem).toMatchInline(`
           Object {
             "group_id": "d16d39e7fa133b8943cea035430a7b4e",
-            "last_seen": 1627975146078,
+            "lastSeen": 1627975146078,
             "name": "Response status 404",
             "occurrences": 17,
           }
diff --git a/x-pack/test/case_api_integration/security_and_spaces/tests/common/cases/patch_cases.ts b/x-pack/test/case_api_integration/security_and_spaces/tests/common/cases/patch_cases.ts
index 6b370117c447a7..e2a75129402504 100644
--- a/x-pack/test/case_api_integration/security_and_spaces/tests/common/cases/patch_cases.ts
+++ b/x-pack/test/case_api_integration/security_and_spaces/tests/common/cases/patch_cases.ts
@@ -805,7 +805,7 @@ export default ({ getService }: FtrProviderContext): void => {
           const signals = await getSignalsByIds(supertest, [id]);
 
           const alert = signals.hits.hits[0];
-          expect(alert._source.signal.status).eql('open');
+          expect(alert._source?.signal.status).eql('open');
 
           const caseUpdated = await createComment({
             supertest,
@@ -846,7 +846,7 @@ export default ({ getService }: FtrProviderContext): void => {
             .send(getQuerySignalIds([alert._id]))
             .expect(200);
 
-          expect(updatedAlert.hits.hits[0]._source.signal.status).eql('in-progress');
+          expect(updatedAlert.hits.hits[0]._source?.signal.status).eql('in-progress');
         });
 
         it('does NOT updates alert status when the status is updated and syncAlerts=false', async () => {
@@ -863,7 +863,7 @@ export default ({ getService }: FtrProviderContext): void => {
           const signals = await getSignalsByIds(supertest, [id]);
 
           const alert = signals.hits.hits[0];
-          expect(alert._source.signal.status).eql('open');
+          expect(alert._source?.signal.status).eql('open');
 
           const caseUpdated = await createComment({
             supertest,
@@ -899,7 +899,7 @@ export default ({ getService }: FtrProviderContext): void => {
             .send(getQuerySignalIds([alert._id]))
             .expect(200);
 
-          expect(updatedAlert.hits.hits[0]._source.signal.status).eql('open');
+          expect(updatedAlert.hits.hits[0]._source?.signal.status).eql('open');
         });
 
         it('it updates alert status when syncAlerts is turned on', async () => {
@@ -916,7 +916,7 @@ export default ({ getService }: FtrProviderContext): void => {
           const signals = await getSignalsByIds(supertest, [id]);
 
           const alert = signals.hits.hits[0];
-          expect(alert._source.signal.status).eql('open');
+          expect(alert._source?.signal.status).eql('open');
 
           const caseUpdated = await createComment({
             supertest,
@@ -970,7 +970,7 @@ export default ({ getService }: FtrProviderContext): void => {
             .send(getQuerySignalIds([alert._id]))
             .expect(200);
 
-          expect(updatedAlert.hits.hits[0]._source.signal.status).eql('in-progress');
+          expect(updatedAlert.hits.hits[0]._source?.signal.status).eql('in-progress');
         });
 
         it('it does NOT updates alert status when syncAlerts is turned off', async () => {
@@ -983,7 +983,7 @@ export default ({ getService }: FtrProviderContext): void => {
           const signals = await getSignalsByIds(supertest, [id]);
 
           const alert = signals.hits.hits[0];
-          expect(alert._source.signal.status).eql('open');
+          expect(alert._source?.signal.status).eql('open');
 
           const caseUpdated = await createComment({
             supertest,
diff --git a/x-pack/test/case_api_integration/security_and_spaces/tests/common/comments/post_comment.ts b/x-pack/test/case_api_integration/security_and_spaces/tests/common/comments/post_comment.ts
index f22ce54de193a4..ecd05a2717e08e 100644
--- a/x-pack/test/case_api_integration/security_and_spaces/tests/common/comments/post_comment.ts
+++ b/x-pack/test/case_api_integration/security_and_spaces/tests/common/comments/post_comment.ts
@@ -369,7 +369,7 @@ export default ({ getService }: FtrProviderContext): void => {
         const signals = await getSignalsByIds(supertest, [id]);
 
         const alert = signals.hits.hits[0];
-        expect(alert._source.signal.status).eql('open');
+        expect(alert._source?.signal.status).eql('open');
 
         await createComment({
           supertest,
@@ -424,7 +424,7 @@ export default ({ getService }: FtrProviderContext): void => {
         const signals = await getSignalsByIds(supertest, [id]);
 
         const alert = signals.hits.hits[0];
-        expect(alert._source.signal.status).eql('open');
+        expect(alert._source?.signal.status).eql('open');
 
         await createComment({
           supertest,
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/open_close_signals.ts b/x-pack/test/detection_engine_api_integration/basic/tests/open_close_signals.ts
index 8c6a698f881093..3dbef66023e580 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/open_close_signals.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/open_close_signals.ts
@@ -7,7 +7,7 @@
 
 import expect from '@kbn/expect';
 
-import { SearchResponse } from 'elasticsearch';
+import type { estypes } from '@elastic/elasticsearch';
 import { Signal } from '../../../../plugins/security_solution/server/lib/detection_engine/signals/types';
 import {
   DETECTION_ENGINE_SIGNALS_STATUS_URL,
@@ -93,11 +93,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForSignalsToBePresent(supertest, 10, [id]);
         const signalsOpen = await getSignalsByIds(supertest, [id]);
         const everySignalOpen = signalsOpen.hits.hits.every(
-          ({
-            _source: {
-              signal: { status },
-            },
-          }) => status === 'open'
+          (hit) => hit._source?.signal?.status === 'open'
         );
         expect(everySignalOpen).to.eql(true);
       });
@@ -121,7 +117,7 @@ export default ({ getService }: FtrProviderContext) => {
 
         const {
           body: signalsClosed,
-        }: { body: SearchResponse<{ signal: Signal }> } = await supertest
+        }: { body: estypes.SearchResponse<{ signal: Signal }> } = await supertest
           .post(DETECTION_ENGINE_QUERY_SIGNALS_URL)
           .set('kbn-xsrf', 'true')
           .send(getQuerySignalIds(signalIds))
@@ -148,18 +144,14 @@ export default ({ getService }: FtrProviderContext) => {
 
         const {
           body: signalsClosed,
-        }: { body: SearchResponse<{ signal: Signal }> } = await supertest
+        }: { body: estypes.SearchResponse<{ signal: Signal }> } = await supertest
           .post(DETECTION_ENGINE_QUERY_SIGNALS_URL)
           .set('kbn-xsrf', 'true')
           .send(getQuerySignalIds(signalIds))
           .expect(200);
 
         const everySignalClosed = signalsClosed.hits.hits.every(
-          ({
-            _source: {
-              signal: { status },
-            },
-          }) => status === 'closed'
+          (hit) => hit._source?.signal?.status === 'closed'
         );
         expect(everySignalClosed).to.eql(true);
       });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/aliases.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/aliases.ts
index 790dc2b725a728..e72c00c31434ed 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/aliases.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/aliases.ts
@@ -46,7 +46,7 @@ export default ({ getService }: FtrProviderContext) => {
       await waitForSignalsToBePresent(supertest, 4, [id]);
       const signalsOpen = await getSignalsById(supertest, id);
       const hits = signalsOpen.hits.hits.map(
-        (signal) => (signal._source.host_alias as HostAlias).name
+        (signal) => (signal._source?.host_alias as HostAlias).name
       );
       expect(hits).to.eql(['host name 1', 'host name 2', 'host name 3', 'host name 4']);
     });
@@ -57,7 +57,7 @@ export default ({ getService }: FtrProviderContext) => {
       await waitForRuleSuccessOrStatus(supertest, id);
       await waitForSignalsToBePresent(supertest, 4, [id]);
       const signalsOpen = await getSignalsById(supertest, id);
-      const hits = signalsOpen.hits.hits.map((signal) => (signal._source.host as HostAlias).name);
+      const hits = signalsOpen.hits.hits.map((signal) => (signal._source?.host as HostAlias).name);
       expect(hits).to.eql(['host name 1', 'host name 2', 'host name 3', 'host name 4']);
     });
   });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_endpoint_exceptions.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_endpoint_exceptions.ts
index 4a50a146421f61..56808b5739eb95 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_endpoint_exceptions.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_endpoint_exceptions.ts
@@ -59,7 +59,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.host).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host).sort();
         expect(hits).to.eql([
           {
             os: { type: 'linux' },
@@ -82,7 +82,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.host).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host).sort();
         expect(hits).to.eql([
           {
             os: { name: 'Linux' },
@@ -125,7 +125,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 3, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.host);
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host);
           expect(hits).to.eql([
             {
               os: { name: 'Windows' },
@@ -162,7 +162,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 3, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.host);
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host);
           expect(hits).to.eql([
             {
               os: { name: 'Windows' },
@@ -210,7 +210,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.host);
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host);
           expect(hits).to.eql([
             {
               os: { name: 'Macos' },
@@ -255,7 +255,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.host);
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host);
           expect(hits).to.eql([
             {
               os: { name: 'Macos' },
@@ -291,7 +291,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 3, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.host);
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host);
           expect(hits).to.eql([
             {
               os: { type: 'windows' },
@@ -328,7 +328,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 3, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.host);
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host);
           expect(hits).to.eql([
             {
               os: { type: 'windows' },
@@ -376,7 +376,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.host);
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host);
           expect(hits).to.eql([
             {
               os: { type: 'macos' },
@@ -421,7 +421,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.host);
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host);
           expect(hits).to.eql([
             {
               os: { type: 'macos' },
@@ -457,7 +457,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 6, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.host);
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host);
           expect(hits).to.eql([
             {
               os: { type: 'windows' },
@@ -503,7 +503,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 6, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.host);
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host);
           expect(hits).to.eql([
             {
               os: { type: 'windows' },
@@ -560,7 +560,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 4, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.host);
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host);
           expect(hits).to.eql([
             {
               os: { type: 'macos' },
@@ -611,7 +611,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 4, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.host);
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host);
           expect(hits).to.eql([
             {
               os: { type: 'macos' },
@@ -663,7 +663,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.host);
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host);
         expect(hits).to.eql([
           {
             os: { type: 'macos' },
@@ -703,7 +703,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.host);
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host);
         expect(hits).to.eql([
           {
             os: { type: 'macos' },
@@ -736,7 +736,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.host);
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host);
         expect(hits).to.eql([
           {
             os: { type: 'linux' },
@@ -773,7 +773,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.host);
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host);
         expect(hits).to.eql([
           {
             os: { type: 'macos' },
@@ -807,7 +807,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.host);
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host);
         expect(hits).to.eql([
           {
             os: { type: 'macos' },
@@ -841,7 +841,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.host);
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.host);
         expect(hits).to.eql([
           {
             os: { type: 'linux' },
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_ml.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_ml.ts
index 6a6822ba7eb2d7..a03bd07c86020a 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_ml.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_ml.ts
@@ -100,6 +100,10 @@ export default ({ getService }: FtrProviderContext) => {
       const signalsOpen = await getOpenSignals(supertest, es, createdRule);
       expect(signalsOpen.hits.hits.length).eql(1);
       const signal = signalsOpen.hits.hits[0];
+      if (!signal._source) {
+        return expect(signal._source).to.be.ok();
+      }
+
       expect(signal._source).eql({
         '@timestamp': signal._source['@timestamp'],
         actual: [1],
@@ -152,7 +156,7 @@ export default ({ getService }: FtrProviderContext) => {
             id: createdRule.id,
             rule_id: createdRule.rule_id,
             created_at: createdRule.created_at,
-            updated_at: signal._source.signal.rule.updated_at,
+            updated_at: signal._source?.signal.rule.updated_at,
             actions: [],
             interval: '5m',
             name: 'Test ML rule',
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_signals_migrations.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_signals_migrations.ts
index 1d33c4c3047cd4..ed1cd4e82ef20d 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_signals_migrations.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_signals_migrations.ts
@@ -13,6 +13,7 @@ import {
 } from '../../../../plugins/security_solution/common/constants';
 import { ROLES } from '../../../../plugins/security_solution/common/test';
 import { SIGNALS_TEMPLATE_VERSION } from '../../../../plugins/security_solution/server/lib/detection_engine/routes/index/get_signals_template';
+import { Signal } from '../../../../plugins/security_solution/server/lib/detection_engine/signals/types';
 import { FtrProviderContext } from '../../common/ftr_provider_context';
 import {
   createSignalsIndex,
@@ -96,12 +97,11 @@ export default ({ getService }: FtrProviderContext): void => {
 
       const [{ migration_index: newIndex }] = createResponses;
       await waitForIndexToPopulate(es, newIndex);
-      const { body: migrationResults } = await es.search({ index: newIndex });
+      const { body: migrationResults } = await es.search<{ signal: Signal }>({ index: newIndex });
 
       expect(migrationResults.hits.hits).length(1);
-      // @ts-expect-error _source has unknown type
-      const migratedSignal = migrationResults.hits.hits[0]._source.signal;
-      expect(migratedSignal._meta.version).to.equal(SIGNALS_TEMPLATE_VERSION);
+      const migratedSignal = migrationResults.hits.hits[0]._source?.signal;
+      expect(migratedSignal?._meta?.version).to.equal(SIGNALS_TEMPLATE_VERSION);
     });
 
     it('specifying the signals alias itself is a bad request', async () => {
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts
index dabf2858dfe0c2..c341761160633b 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts
@@ -153,9 +153,12 @@ export default ({ getService }: FtrProviderContext) => {
         const signalsOpen = await getSignalsByIds(supertest, [id]);
         expect(signalsOpen.hits.hits.length).equal(10);
         const fullSource = signalsOpen.hits.hits.find(
-          (signal) => signal._source.signal.parents[0].id === '7yJ-B2kBR346wHgnhlMn'
+          (signal) => signal._source?.signal.parents[0].id === '7yJ-B2kBR346wHgnhlMn'
         );
-        const fullSignal = fullSource!._source; // If this doesn't exist the test is going to fail anyway so using a bang operator here to get rid of ts error
+        const fullSignal = fullSource?._source;
+        if (!fullSignal) {
+          return expect(fullSignal).to.be.ok();
+        }
         expect(fullSignal).eql({
           '@timestamp': fullSignal['@timestamp'],
           agent: {
@@ -439,7 +442,7 @@ export default ({ getService }: FtrProviderContext) => {
           expect(signalsOpen.hits.hits.length).equal(2);
 
           const { hits } = signalsOpen.hits;
-          const threats = hits.map((hit) => hit._source.threat);
+          const threats = hits.map((hit) => hit._source?.threat);
           expect(threats).to.eql([
             {
               indicator: [
@@ -544,7 +547,9 @@ export default ({ getService }: FtrProviderContext) => {
           expect(signalsOpen.hits.hits.length).equal(1);
 
           const { hits } = signalsOpen.hits;
-          const [threat] = hits.map((hit) => hit._source.threat) as Array<{ indicator: unknown[] }>;
+          const [threat] = hits.map((hit) => hit._source?.threat) as Array<{
+            indicator: unknown[];
+          }>;
 
           assertContains(threat.indicator, [
             {
@@ -644,7 +649,9 @@ export default ({ getService }: FtrProviderContext) => {
           expect(signalsOpen.hits.hits.length).equal(1);
 
           const { hits } = signalsOpen.hits;
-          const [threat] = hits.map((hit) => hit._source.threat) as Array<{ indicator: unknown[] }>;
+          const [threat] = hits.map((hit) => hit._source?.threat) as Array<{
+            indicator: unknown[];
+          }>;
 
           assertContains(threat.indicator, [
             {
@@ -779,7 +786,7 @@ export default ({ getService }: FtrProviderContext) => {
           expect(signalsOpen.hits.hits.length).equal(2);
 
           const { hits } = signalsOpen.hits;
-          const threats = hits.map((hit) => hit._source.threat) as Array<{ indicator: unknown[] }>;
+          const threats = hits.map((hit) => hit._source?.threat) as Array<{ indicator: unknown[] }>;
 
           assertContains(threats[0].indicator, [
             {
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/date.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/date.ts
index ebbf91fed451ac..280bc3099dd1ae 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/date.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/date.ts
@@ -54,7 +54,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([
           '2020-10-01T05:08:53.000Z',
           '2020-10-02T05:08:53.000Z',
@@ -78,7 +78,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([
           '2020-10-02T05:08:53.000Z',
           '2020-10-03T05:08:53.000Z',
@@ -109,7 +109,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-03T05:08:53.000Z', '2020-10-04T05:08:53.000Z']);
       });
 
@@ -144,7 +144,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-04T05:08:53.000Z']);
       });
 
@@ -186,7 +186,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -206,7 +206,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
 
@@ -225,7 +225,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-01T05:08:53.000Z']);
       });
 
@@ -251,7 +251,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -272,7 +272,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([
           '2020-10-02T05:08:53.000Z',
           '2020-10-03T05:08:53.000Z',
@@ -295,7 +295,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-03T05:08:53.000Z', '2020-10-04T05:08:53.000Z']);
       });
 
@@ -318,7 +318,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-04T05:08:53.000Z']);
       });
 
@@ -341,7 +341,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -361,7 +361,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
 
@@ -380,7 +380,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-01T05:08:53.000Z', '2020-10-04T05:08:53.000Z']);
       });
     });
@@ -399,7 +399,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -419,7 +419,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([
           '2020-10-01T05:08:53.000Z',
           '2020-10-02T05:08:53.000Z',
@@ -449,7 +449,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([
           '2020-10-02T05:08:53.000Z',
           '2020-10-03T05:08:53.000Z',
@@ -481,7 +481,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-02T05:08:53.000Z', '2020-10-04T05:08:53.000Z']);
       });
 
@@ -513,7 +513,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -538,7 +538,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-01T05:08:53.000Z']);
       });
 
@@ -566,7 +566,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-01T05:08:53.000Z', '2020-10-03T05:08:53.000Z']);
       });
 
@@ -599,7 +599,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.date).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([
           '2020-10-01T05:08:53.000Z',
           '2020-10-02T05:08:53.000Z',
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/double.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/double.ts
index 0ae52b86e3d779..152fd46fdf6a2f 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/double.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/double.ts
@@ -58,7 +58,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
       });
 
@@ -77,7 +77,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.1', '1.2', '1.3']);
       });
 
@@ -104,7 +104,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.2', '1.3']);
       });
 
@@ -139,7 +139,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.3']);
       });
 
@@ -181,7 +181,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -201,7 +201,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql([]);
       });
 
@@ -220,7 +220,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.0']);
       });
 
@@ -246,7 +246,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -267,7 +267,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.1', '1.2', '1.3']);
       });
 
@@ -286,7 +286,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.2', '1.3']);
       });
 
@@ -305,7 +305,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.3']);
       });
 
@@ -323,7 +323,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -343,7 +343,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql([]);
       });
 
@@ -362,7 +362,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.0', '1.3']);
       });
     });
@@ -381,7 +381,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -401,7 +401,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
       });
     });
@@ -427,7 +427,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 3, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.1', '1.2', '1.3']);
         });
 
@@ -450,7 +450,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.1', '1.3']);
         });
 
@@ -472,7 +472,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]);
           await waitForRuleSuccessOrStatus(supertest, id);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql([]);
         });
       });
@@ -497,7 +497,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.1', '1.2', '1.3']);
         });
 
@@ -520,7 +520,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.1', '1.3']);
         });
 
@@ -542,7 +542,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]);
           await waitForRuleSuccessOrStatus(supertest, id);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql([]);
         });
 
@@ -568,7 +568,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.3']);
         });
       });
@@ -595,7 +595,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0']);
         });
 
@@ -618,7 +618,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0', '1.2']);
         });
 
@@ -641,7 +641,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 4, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
         });
       });
@@ -666,7 +666,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0']);
         });
 
@@ -689,7 +689,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0', '1.2']);
         });
 
@@ -712,7 +712,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 4, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
         });
 
@@ -738,7 +738,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 3, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.double).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0', '1.1', '1.2']);
         });
       });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/float.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/float.ts
index 7d5d8a215a982c..d3b93cbab1124f 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/float.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/float.ts
@@ -56,7 +56,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
       });
 
@@ -75,7 +75,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.1', '1.2', '1.3']);
       });
 
@@ -102,7 +102,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.2', '1.3']);
       });
 
@@ -137,7 +137,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.3']);
       });
 
@@ -179,7 +179,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -199,7 +199,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql([]);
       });
 
@@ -218,7 +218,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.0']);
       });
 
@@ -244,7 +244,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -265,7 +265,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.1', '1.2', '1.3']);
       });
 
@@ -284,7 +284,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.2', '1.3']);
       });
 
@@ -303,7 +303,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.3']);
       });
 
@@ -321,7 +321,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -341,7 +341,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql([]);
       });
 
@@ -360,7 +360,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.0', '1.3']);
       });
     });
@@ -379,7 +379,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -399,7 +399,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
       });
     });
@@ -425,7 +425,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 3, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.1', '1.2', '1.3']);
         });
 
@@ -448,7 +448,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.1', '1.3']);
         });
 
@@ -470,7 +470,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]);
           await waitForRuleSuccessOrStatus(supertest, id);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql([]);
         });
       });
@@ -495,7 +495,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.1', '1.2', '1.3']);
         });
 
@@ -518,7 +518,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.1', '1.3']);
         });
 
@@ -540,7 +540,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]);
           await waitForRuleSuccessOrStatus(supertest, id);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql([]);
         });
 
@@ -563,7 +563,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.3']);
         });
       });
@@ -590,7 +590,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0']);
         });
 
@@ -613,7 +613,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0', '1.2']);
         });
 
@@ -636,7 +636,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 4, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
         });
       });
@@ -661,7 +661,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0']);
         });
 
@@ -684,7 +684,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0', '1.2']);
         });
 
@@ -707,7 +707,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 4, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
         });
 
@@ -730,7 +730,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 3, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.float).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0', '1.1', '1.2']);
         });
       });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/integer.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/integer.ts
index 8d73262147287c..6bfaea982a4071 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/integer.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/integer.ts
@@ -58,7 +58,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['1', '2', '3', '4']);
       });
 
@@ -77,7 +77,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['2', '3', '4']);
       });
 
@@ -104,7 +104,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['3', '4']);
       });
 
@@ -139,7 +139,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['4']);
       });
 
@@ -181,7 +181,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -201,7 +201,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql([]);
       });
 
@@ -220,7 +220,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['1']);
       });
 
@@ -246,7 +246,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -267,7 +267,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['2', '3', '4']);
       });
 
@@ -286,7 +286,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['3', '4']);
       });
 
@@ -305,7 +305,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['4']);
       });
 
@@ -323,7 +323,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -343,7 +343,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql([]);
       });
 
@@ -362,7 +362,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['1', '4']);
       });
     });
@@ -381,7 +381,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -401,7 +401,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['1', '2', '3', '4']);
       });
     });
@@ -427,7 +427,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 3, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['2', '3', '4']);
         });
 
@@ -450,7 +450,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['2', '4']);
         });
 
@@ -472,7 +472,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]);
           await waitForRuleSuccessOrStatus(supertest, id);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql([]);
         });
       });
@@ -497,7 +497,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['2', '3', '4']);
         });
 
@@ -520,7 +520,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['2', '4']);
         });
 
@@ -542,7 +542,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]);
           await waitForRuleSuccessOrStatus(supertest, id);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql([]);
         });
 
@@ -565,7 +565,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['4']);
         });
       });
@@ -592,7 +592,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1']);
         });
 
@@ -615,7 +615,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1', '3']);
         });
 
@@ -638,7 +638,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 4, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1', '2', '3', '4']);
         });
       });
@@ -663,7 +663,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1']);
         });
 
@@ -686,7 +686,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1', '3']);
         });
 
@@ -709,7 +709,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 4, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1', '2', '3', '4']);
         });
 
@@ -732,7 +732,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 3, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.integer).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1', '2', '3']);
         });
       });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip.ts
index 9acbe0da6f27ca..cf7b072a5e049f 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip.ts
@@ -54,7 +54,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4']);
       });
 
@@ -73,7 +73,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.2', '127.0.0.3', '127.0.0.4']);
       });
 
@@ -100,7 +100,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.3', '127.0.0.4']);
       });
 
@@ -135,7 +135,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.4']);
       });
 
@@ -177,7 +177,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
 
@@ -196,7 +196,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.4']);
       });
     });
@@ -216,7 +216,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
 
@@ -235,7 +235,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1']);
       });
 
@@ -261,7 +261,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
     });
@@ -282,7 +282,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.2', '127.0.0.3', '127.0.0.4']);
       });
 
@@ -301,7 +301,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.3', '127.0.0.4']);
       });
 
@@ -320,7 +320,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.4']);
       });
 
@@ -338,7 +338,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
     });
@@ -358,7 +358,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
 
@@ -377,7 +377,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.4']);
       });
     });
@@ -396,7 +396,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
     });
@@ -416,7 +416,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4']);
       });
     });
@@ -441,7 +441,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.2', '127.0.0.3', '127.0.0.4']);
       });
 
@@ -464,7 +464,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.2', '127.0.0.4']);
       });
 
@@ -491,7 +491,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
 
@@ -518,7 +518,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.4']);
       });
 
@@ -545,7 +545,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.4']);
       });
 
@@ -574,7 +574,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.4']);
       });
     });
@@ -599,7 +599,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1']);
       });
 
@@ -622,7 +622,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.3']);
       });
 
@@ -650,7 +650,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4']);
       });
 
@@ -677,7 +677,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.2', '127.0.0.3']);
       });
 
@@ -704,7 +704,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.2', '127.0.0.3']);
       });
     });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip_array.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip_array.ts
index 16b3ab2958c9f5..1b05106ac3d31e 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip_array.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip_array.ts
@@ -54,7 +54,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           [],
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
@@ -78,7 +78,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           [],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
@@ -109,7 +109,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[], ['127.0.0.8', '127.0.0.9', '127.0.0.10']]);
       });
 
@@ -144,7 +144,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[]]);
       });
 
@@ -163,7 +163,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           [],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
@@ -186,7 +186,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[], ['127.0.0.8', '127.0.0.9', '127.0.0.10']]);
       });
     });
@@ -206,7 +206,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
 
@@ -225,7 +225,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4']]);
       });
 
@@ -250,7 +250,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4']]);
       });
 
@@ -276,7 +276,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
     });
@@ -297,7 +297,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           [],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
@@ -320,7 +320,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[], ['127.0.0.8', '127.0.0.9', '127.0.0.10']]);
       });
 
@@ -339,7 +339,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[]]);
       });
     });
@@ -359,7 +359,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
 
@@ -378,7 +378,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
@@ -400,7 +400,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[]]);
       });
     });
@@ -420,7 +420,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
@@ -449,7 +449,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           [],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
@@ -476,7 +476,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[], ['127.0.0.8', '127.0.0.9', '127.0.0.10']]);
       });
 
@@ -503,7 +503,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[]]);
       });
 
@@ -540,7 +540,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[], ['127.0.0.8', '127.0.0.9', '127.0.0.10']]);
       });
 
@@ -571,7 +571,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[], ['127.0.0.8', '127.0.0.9', '127.0.0.10']]);
       });
     });
@@ -596,7 +596,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4']]);
       });
 
@@ -619,7 +619,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
@@ -650,7 +650,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
@@ -691,7 +691,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
@@ -725,7 +725,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const ips = signalsOpen.hits.hits.map((hit) => hit._source.ip).sort();
+        const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
           ['127.0.0.5', null, '127.0.0.6', '127.0.0.7'],
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword.ts
index 29fbd2423956f7..73ae9cc191e9fc 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword.ts
@@ -54,7 +54,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
 
@@ -73,7 +73,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
 
@@ -100,7 +100,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word three']);
       });
 
@@ -135,7 +135,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four']);
       });
 
@@ -177,7 +177,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -197,7 +197,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
 
@@ -216,7 +216,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word one']);
       });
 
@@ -242,7 +242,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -263,7 +263,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
 
@@ -282,7 +282,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word three']);
       });
 
@@ -301,7 +301,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four']);
       });
 
@@ -319,7 +319,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -339,7 +339,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
 
@@ -358,7 +358,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word one']);
       });
     });
@@ -377,7 +377,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -397,7 +397,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
     });
@@ -432,7 +432,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
 
@@ -455,7 +455,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
 
@@ -478,7 +478,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word two']);
       });
 
@@ -505,7 +505,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -530,7 +530,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word one']);
       });
 
@@ -553,7 +553,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word one', 'word three']);
       });
 
@@ -581,7 +581,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
     });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword_array.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword_array.ts
index f3b49558bb99d3..8fff5e3580f138 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword_array.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword_array.ts
@@ -56,7 +56,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -80,7 +80,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -111,7 +111,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([[], ['word eight', 'word nine', 'word ten']]);
       });
 
@@ -146,7 +146,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([[]]);
       });
     });
@@ -166,7 +166,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
 
@@ -185,7 +185,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([['word one', 'word two', 'word three', 'word four']]);
       });
 
@@ -211,7 +211,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -232,7 +232,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -255,7 +255,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([[], ['word eight', 'word nine', 'word ten']]);
       });
 
@@ -274,7 +274,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([[]]);
       });
     });
@@ -294,7 +294,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
 
@@ -313,7 +313,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           ['word five', null, 'word six', 'word seven'],
           ['word one', 'word two', 'word three', 'word four'],
@@ -335,7 +335,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([[]]);
       });
     });
@@ -355,7 +355,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           ['word eight', 'word nine', 'word ten'],
           ['word five', null, 'word six', 'word seven'],
@@ -394,7 +394,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -432,7 +432,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -459,7 +459,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -486,7 +486,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([[], ['word eight', 'word nine', 'word ten']]);
       });
 
@@ -513,7 +513,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([[]]);
       });
     });
@@ -538,7 +538,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([['word one', 'word two', 'word three', 'word four']]);
       });
 
@@ -561,7 +561,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([['word one', 'word two', 'word three', 'word four']]);
       });
 
@@ -584,7 +584,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           ['word five', null, 'word six', 'word seven'],
           ['word one', 'word two', 'word three', 'word four'],
@@ -615,7 +615,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.keyword).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           ['word eight', 'word nine', 'word ten'],
           ['word five', null, 'word six', 'word seven'],
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/long.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/long.ts
index 55896212c2fd8f..4af1b426bbfedb 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/long.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/long.ts
@@ -56,7 +56,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['1', '2', '3', '4']);
       });
 
@@ -75,7 +75,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['2', '3', '4']);
       });
 
@@ -102,7 +102,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['3', '4']);
       });
 
@@ -137,7 +137,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['4']);
       });
 
@@ -179,7 +179,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -199,7 +199,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql([]);
       });
 
@@ -218,7 +218,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['1']);
       });
 
@@ -244,7 +244,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -265,7 +265,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['2', '3', '4']);
       });
 
@@ -284,7 +284,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['3', '4']);
       });
 
@@ -303,7 +303,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['4']);
       });
 
@@ -321,7 +321,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -341,7 +341,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql([]);
       });
 
@@ -360,7 +360,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['1', '4']);
       });
     });
@@ -379,7 +379,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -399,7 +399,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['1', '2', '3', '4']);
       });
     });
@@ -425,7 +425,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 3, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['2', '3', '4']);
         });
 
@@ -448,7 +448,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['2', '4']);
         });
 
@@ -470,7 +470,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]);
           await waitForRuleSuccessOrStatus(supertest, id);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql([]);
         });
       });
@@ -495,7 +495,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['2', '3', '4']);
         });
 
@@ -518,7 +518,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['2', '4']);
         });
 
@@ -540,7 +540,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]);
           await waitForRuleSuccessOrStatus(supertest, id);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql([]);
         });
 
@@ -563,7 +563,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['4']);
         });
       });
@@ -590,7 +590,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1']);
         });
 
@@ -613,7 +613,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1', '3']);
         });
 
@@ -636,7 +636,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 4, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1', '2', '3', '4']);
         });
       });
@@ -661,7 +661,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1']);
         });
 
@@ -684,7 +684,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1', '3']);
         });
 
@@ -707,7 +707,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 4, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1', '2', '3', '4']);
         });
 
@@ -730,7 +730,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 3, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.long).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1', '2', '3']);
         });
       });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text.ts
index 046d4100b1ee42..dbffeacb03b77e 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text.ts
@@ -50,14 +50,15 @@ export default ({ getService }: FtrProviderContext) => {
       await esArchiver.unload('x-pack/test/functional/es_archives/rule_exceptions/text_no_spaces');
     });
 
-    describe('"is" operator', () => {
+    // FLAKY: https://github.com/elastic/kibana/issues/107856
+    describe.skip('"is" operator', () => {
       it('should find all the text from the data set when no exceptions are set on the rule', async () => {
         const rule = getRuleForSignalTesting(['text']);
         const { id } = await createRule(supertest, rule);
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
 
@@ -76,7 +77,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
 
@@ -103,7 +104,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word three']);
       });
 
@@ -138,7 +139,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four']);
       });
 
@@ -180,7 +181,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
@@ -199,7 +200,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
 
@@ -217,7 +218,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
@@ -236,7 +237,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
     });
@@ -256,7 +257,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
@@ -275,7 +276,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word one']);
       });
 
@@ -301,7 +302,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
@@ -320,7 +321,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word one']);
       });
 
@@ -338,7 +339,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
 
@@ -357,7 +358,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word one']);
       });
     });
@@ -378,7 +379,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
 
@@ -397,7 +398,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word three']);
       });
 
@@ -416,7 +417,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four']);
       });
 
@@ -434,7 +435,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -454,7 +455,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
@@ -473,7 +474,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word one']);
       });
     });
@@ -492,7 +493,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -512,7 +513,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
     });
@@ -538,7 +539,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 3, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['four', 'three', 'two']);
         });
 
@@ -561,7 +562,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['four', 'two']);
         });
 
@@ -588,7 +589,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]);
           await waitForRuleSuccessOrStatus(supertest, id);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql([]);
         });
       });
@@ -613,7 +614,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word four', 'word three', 'word two']);
         });
 
@@ -641,7 +642,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word four', 'word three', 'word two']);
         });
 
@@ -664,7 +665,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word four', 'word two']);
         });
 
@@ -691,7 +692,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]);
           await waitForRuleSuccessOrStatus(supertest, id);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql([]);
         });
       });
@@ -718,7 +719,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['one']);
         });
 
@@ -741,7 +742,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 2, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['one', 'three']);
         });
 
@@ -769,7 +770,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 4, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['four', 'one', 'three', 'two']);
         });
       });
@@ -794,7 +795,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word one']);
         });
 
@@ -822,7 +823,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word one']);
         });
 
@@ -845,7 +846,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word one', 'word three']);
         });
 
@@ -873,7 +874,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsById(supertest, id);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
         });
       });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text_array.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text_array.ts
index 377019e4e40e6b..6512db22c2eb37 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text_array.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text_array.ts
@@ -54,7 +54,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -78,7 +78,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -109,7 +109,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([[], ['word eight', 'word nine', 'word ten']]);
       });
 
@@ -144,7 +144,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([[]]);
       });
     });
@@ -164,7 +164,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
@@ -183,7 +183,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([['word one', 'word two', 'word three', 'word four']]);
       });
 
@@ -209,7 +209,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
     });
@@ -230,7 +230,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -253,7 +253,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([[], ['word eight', 'word nine', 'word ten']]);
       });
 
@@ -272,7 +272,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([[]]);
       });
     });
@@ -292,7 +292,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
@@ -311,7 +311,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           ['word five', null, 'word six', 'word seven'],
           ['word one', 'word two', 'word three', 'word four'],
@@ -333,7 +333,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([[]]);
       });
     });
@@ -353,7 +353,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           ['word eight', 'word nine', 'word ten'],
           ['word five', null, 'word six', 'word seven'],
@@ -392,7 +392,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -430,7 +430,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -457,7 +457,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           [],
           ['word eight', 'word nine', 'word ten'],
@@ -484,7 +484,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([[], ['word eight', 'word nine', 'word ten']]);
       });
 
@@ -511,7 +511,7 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
         await waitForRuleSuccessOrStatus(supertest, id);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([[]]);
       });
     });
@@ -536,7 +536,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([['word one', 'word two', 'word three', 'word four']]);
       });
 
@@ -559,7 +559,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([['word one', 'word two', 'word three', 'word four']]);
       });
 
@@ -582,7 +582,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 2, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           ['word five', null, 'word six', 'word seven'],
           ['word one', 'word two', 'word three', 'word four'],
@@ -608,7 +608,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 3, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((hit) => hit._source.text).sort();
+        const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           ['word eight', 'word nine', 'word ten'],
           ['word five', null, 'word six', 'word seven'],
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts
index 4972b485be06c7..66c94a7317b721 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts
@@ -6,7 +6,7 @@
  */
 
 import expect from '@kbn/expect';
-import { orderBy, get } from 'lodash';
+import { orderBy, get, omit } from 'lodash';
 
 import {
   EqlCreateSchema,
@@ -98,7 +98,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsByIds(supertest, [id]);
-        expect(signalsOpen.hits.hits[0]._source.signal.rule.rule_id).eql(getSimpleRule().rule_id);
+        expect(signalsOpen.hits.hits[0]._source?.signal.rule.rule_id).eql(getSimpleRule().rule_id);
       });
 
       it('should query and get back expected signal structure using a basic KQL query', async () => {
@@ -110,8 +110,10 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsByIds(supertest, [id]);
+        const signal = signalsOpen.hits.hits[0]._source?.signal;
         // remove rule to cut down on touch points for test changes when the rule format changes
-        const { rule: removedRule, ...signalNoRule } = signalsOpen.hits.hits[0]._source.signal;
+        const signalNoRule = omit(signal, 'rule');
+
         expect(signalNoRule).eql({
           parents: [
             {
@@ -161,8 +163,9 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsByIds(supertest, [id]);
+        const signal = signalsOpen.hits.hits[0]._source?.signal;
         // remove rule to cut down on touch points for test changes when the rule format changes
-        const { rule: removedRule, ...signalNoRule } = signalsOpen.hits.hits[0]._source.signal;
+        const signalNoRule = omit(signal, 'rule');
         expect(signalNoRule).eql({
           parents: [
             {
@@ -223,8 +226,9 @@ export default ({ getService }: FtrProviderContext) => {
         // Get our single signal on top of a signal
         const signalsOpen = await getSignalsByRuleIds(supertest, ['signal-on-signal']);
 
+        const signal = signalsOpen.hits.hits[0]._source?.signal;
         // remove rule to cut down on touch points for test changes when the rule format changes
-        const { rule: removedRule, ...signalNoRule } = signalsOpen.hits.hits[0]._source.signal;
+        const signalNoRule = omit(signal, 'rule');
         expect(signalNoRule).eql({
           parents: [
             {
@@ -284,6 +288,9 @@ export default ({ getService }: FtrProviderContext) => {
           const signals = await getSignalsByIds(supertest, [id]);
           expect(signals.hits.hits.length).eql(1);
           const fullSignal = signals.hits.hits[0]._source;
+          if (!fullSignal) {
+            return expect(fullSignal).to.be.ok();
+          }
 
           expect(fullSignal).eql({
             '@timestamp': fullSignal['@timestamp'],
@@ -398,7 +405,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForSignalsToBePresent(supertest, 100, [id]);
           const signals = await getSignalsByIds(supertest, [id], 1000);
           const filteredSignals = signals.hits.hits.filter(
-            (signal) => signal._source.signal.depth === 1
+            (signal) => signal._source?.signal.depth === 1
           );
           expect(filteredSignals.length).eql(100);
         });
@@ -415,6 +422,9 @@ export default ({ getService }: FtrProviderContext) => {
           const signals = await getSignalsByIds(supertest, [id]);
           expect(signals.hits.hits.length).eql(1);
           const fullSignal = signals.hits.hits[0]._source;
+          if (!fullSignal) {
+            return expect(fullSignal).to.be.ok();
+          }
 
           expect(fullSignal).eql({
             '@timestamp': fullSignal['@timestamp'],
@@ -533,11 +543,14 @@ export default ({ getService }: FtrProviderContext) => {
           const signals = await getSignalsByIds(supertest, [id]);
           const buildingBlock = signals.hits.hits.find(
             (signal) =>
-              signal._source.signal.depth === 1 &&
+              signal._source?.signal.depth === 1 &&
               get(signal._source, 'signal.original_event.category') === 'anomoly'
           );
           expect(buildingBlock).not.eql(undefined);
-          const fullSignal = buildingBlock!._source;
+          const fullSignal = buildingBlock?._source;
+          if (!fullSignal) {
+            return expect(fullSignal).to.be.ok();
+          }
 
           expect(fullSignal).eql({
             '@timestamp': fullSignal['@timestamp'],
@@ -694,12 +707,15 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForSignalsToBePresent(supertest, 3, [id]);
           const signalsOpen = await getSignalsByIds(supertest, [id]);
           const sequenceSignal = signalsOpen.hits.hits.find(
-            (signal) => signal._source.signal.depth === 2
+            (signal) => signal._source?.signal.depth === 2
           );
-          const source = sequenceSignal!._source;
-          const eventIds = source.signal.parents.map((event) => event.id);
+          const source = sequenceSignal?._source;
+          if (!source) {
+            return expect(source).to.be.ok();
+          }
+          const eventIds = source?.signal.parents.map((event) => event.id);
           expect(source).eql({
-            '@timestamp': source['@timestamp'],
+            '@timestamp': source && source['@timestamp'],
             agent: {
               ephemeral_id: '1b4978a0-48be-49b1-ac96-323425b389ab',
               hostname: 'zeek-sensor-amsterdam',
@@ -798,10 +814,10 @@ export default ({ getService }: FtrProviderContext) => {
           const signalsOpen = await getSignalsByIds(supertest, [id], 1000);
           expect(signalsOpen.hits.hits.length).eql(300);
           const shellSignals = signalsOpen.hits.hits.filter(
-            (signal) => signal._source.signal.depth === 2
+            (signal) => signal._source?.signal.depth === 2
           );
           const buildingBlocks = signalsOpen.hits.hits.filter(
-            (signal) => signal._source.signal.depth === 1
+            (signal) => signal._source?.signal.depth === 1
           );
           expect(shellSignals.length).eql(100);
           expect(buildingBlocks.length).eql(200);
@@ -823,6 +839,9 @@ export default ({ getService }: FtrProviderContext) => {
           const signalsOpen = await getSignalsByIds(supertest, [id]);
           expect(signalsOpen.hits.hits.length).eql(1);
           const fullSignal = signalsOpen.hits.hits[0]._source;
+          if (!fullSignal) {
+            return expect(fullSignal).to.be.ok();
+          }
           const eventIds = fullSignal.signal.parents.map((event) => event.id);
           expect(fullSignal).eql({
             '@timestamp': fullSignal['@timestamp'],
@@ -957,6 +976,9 @@ export default ({ getService }: FtrProviderContext) => {
           const signalsOpen = await getOpenSignals(supertest, es, createdRule);
           expect(signalsOpen.hits.hits.length).eql(1);
           const fullSignal = signalsOpen.hits.hits[0]._source;
+          if (!fullSignal) {
+            return expect(fullSignal).to.be.ok();
+          }
           const eventIds = fullSignal.signal.parents.map((event) => event.id);
           expect(fullSignal).eql({
             '@timestamp': fullSignal['@timestamp'],
@@ -1035,6 +1057,9 @@ export default ({ getService }: FtrProviderContext) => {
           const signalsOpen = await getOpenSignals(supertest, es, createdRule);
           expect(signalsOpen.hits.hits.length).eql(1);
           const fullSignal = signalsOpen.hits.hits[0]._source;
+          if (!fullSignal) {
+            return expect(fullSignal).to.be.ok();
+          }
           const eventIds = fullSignal.signal.parents.map((event) => event.id);
           expect(fullSignal).eql({
             '@timestamp': fullSignal['@timestamp'],
@@ -1132,7 +1157,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsByIds(supertest, [id]);
-        expect(signalsOpen.hits.hits[0]._source.signal.rule.rule_id).eql(getSimpleRule().rule_id);
+        expect(signalsOpen.hits.hits[0]._source?.signal.rule.rule_id).eql(getSimpleRule().rule_id);
       });
 
       it('should query and get back expected signal structure using a basic KQL query', async () => {
@@ -1144,8 +1169,9 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsByIds(supertest, [id]);
+        const signal = signalsOpen.hits.hits[0]._source?.signal;
         // remove rule to cut down on touch points for test changes when the rule format changes
-        const { rule: removedRule, ...signalNoRule } = signalsOpen.hits.hits[0]._source.signal;
+        const signalNoRule = omit(signal, 'rule');
         expect(signalNoRule).eql({
           parents: [
             {
@@ -1200,8 +1226,9 @@ export default ({ getService }: FtrProviderContext) => {
         // Get our single signal on top of a signal
         const signalsOpen = await getSignalsByRuleIds(supertest, ['signal-on-signal']);
 
+        const signal = signalsOpen.hits.hits[0]._source?.signal;
         // remove rule to cut down on touch points for test changes when the rule format changes
-        const { rule: removedRule, ...signalNoRule } = signalsOpen.hits.hits[0]._source.signal;
+        const signalNoRule = omit(signal, 'rule');
 
         expect(signalNoRule).eql({
           parents: [
@@ -1284,7 +1311,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsByIds(supertest, [id]);
-        expect(signalsOpen.hits.hits[0]._source.signal.rule.rule_id).eql(getSimpleRule().rule_id);
+        expect(signalsOpen.hits.hits[0]._source?.signal.rule.rule_id).eql(getSimpleRule().rule_id);
       });
 
       it('should query and get back expected signal structure using a basic KQL query', async () => {
@@ -1296,8 +1323,9 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsByIds(supertest, [id]);
+        const signal = signalsOpen.hits.hits[0]._source?.signal;
         // remove rule to cut down on touch points for test changes when the rule format changes
-        const { rule: removedRule, ...signalNoRule } = signalsOpen.hits.hits[0]._source.signal;
+        const signalNoRule = omit(signal, 'rule');
         expect(signalNoRule).eql({
           parents: [
             {
@@ -1357,9 +1385,9 @@ export default ({ getService }: FtrProviderContext) => {
 
         // Get our single signal on top of a signal
         const signalsOpen = await getSignalsByRuleIds(supertest, ['signal-on-signal']);
-
+        const signal = signalsOpen.hits.hits[0]._source?.signal;
         // remove rule to cut down on touch points for test changes when the rule format changes
-        const { rule: removedRule, ...signalNoRule } = signalsOpen.hits.hits[0]._source.signal;
+        const signalNoRule = omit(signal, 'rule');
 
         expect(signalNoRule).eql({
           parents: [
@@ -1443,11 +1471,11 @@ export default ({ getService }: FtrProviderContext) => {
 
         expect(signals.length).equal(4);
         signals.forEach((s) => {
-          expect(s.signal.rule.severity).equal('medium');
-          expect(s.signal.rule.severity_mapping).eql([]);
+          expect(s?.signal.rule.severity).equal('medium');
+          expect(s?.signal.rule.severity_mapping).eql([]);
 
-          expect(s.signal.rule.risk_score).equal(75);
-          expect(s.signal.rule.risk_score_mapping).eql([]);
+          expect(s?.signal.rule.risk_score).equal(75);
+          expect(s?.signal.rule.risk_score_mapping).eql([]);
         });
       });
 
@@ -1464,8 +1492,8 @@ export default ({ getService }: FtrProviderContext) => {
 
         const signals = await executeRuleAndGetSignals(rule);
         const severities = signals.map((s) => ({
-          id: s.signal.parent?.id,
-          value: s.signal.rule.severity,
+          id: s?.signal.parent?.id,
+          value: s?.signal.rule.severity,
         }));
 
         expect(signals.length).equal(4);
@@ -1477,9 +1505,9 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
 
         signals.forEach((s) => {
-          expect(s.signal.rule.risk_score).equal(75);
-          expect(s.signal.rule.risk_score_mapping).eql([]);
-          expect(s.signal.rule.severity_mapping).eql([
+          expect(s?.signal.rule.risk_score).equal(75);
+          expect(s?.signal.rule.risk_score_mapping).eql([]);
+          expect(s?.signal.rule.severity_mapping).eql([
             { field: 'my_severity', operator: 'equals', value: 'sev_900', severity: 'high' },
             { field: 'my_severity', operator: 'equals', value: 'sev_max', severity: 'critical' },
           ]);
@@ -1498,8 +1526,8 @@ export default ({ getService }: FtrProviderContext) => {
 
         const signals = await executeRuleAndGetSignals(rule);
         const riskScores = signals.map((s) => ({
-          id: s.signal.parent?.id,
-          value: s.signal.rule.risk_score,
+          id: s?.signal.parent?.id,
+          value: s?.signal.rule.risk_score,
         }));
 
         expect(signals.length).equal(4);
@@ -1511,9 +1539,9 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
 
         signals.forEach((s) => {
-          expect(s.signal.rule.severity).equal('medium');
-          expect(s.signal.rule.severity_mapping).eql([]);
-          expect(s.signal.rule.risk_score_mapping).eql([
+          expect(s?.signal.rule.severity).equal('medium');
+          expect(s?.signal.rule.severity_mapping).eql([]);
+          expect(s?.signal.rule.risk_score_mapping).eql([
             { field: 'my_risk', operator: 'equals', value: '' },
           ]);
         });
@@ -1535,9 +1563,9 @@ export default ({ getService }: FtrProviderContext) => {
 
         const signals = await executeRuleAndGetSignals(rule);
         const values = signals.map((s) => ({
-          id: s.signal.parent?.id,
-          severity: s.signal.rule.severity,
-          risk: s.signal.rule.risk_score,
+          id: s?.signal.parent?.id,
+          severity: s?.signal.rule.severity,
+          risk: s?.signal.rule.risk_score,
         }));
 
         expect(signals.length).equal(4);
@@ -1549,11 +1577,11 @@ export default ({ getService }: FtrProviderContext) => {
         ]);
 
         signals.forEach((s) => {
-          expect(s.signal.rule.severity_mapping).eql([
+          expect(s?.signal.rule.severity_mapping).eql([
             { field: 'my_severity', operator: 'equals', value: 'sev_900', severity: 'high' },
             { field: 'my_severity', operator: 'equals', value: 'sev_max', severity: 'critical' },
           ]);
-          expect(s.signal.rule.risk_score_mapping).eql([
+          expect(s?.signal.rule.risk_score_mapping).eql([
             { field: 'my_risk', operator: 'equals', value: '' },
           ]);
         });
@@ -1587,6 +1615,9 @@ export default ({ getService }: FtrProviderContext) => {
         const signals = signalsResponse.hits.hits.map((hit) => hit._source);
         const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
         const fullSignal = signalsOrderedByEventId[0];
+        if (!fullSignal) {
+          return expect(fullSignal).to.be.ok();
+        }
 
         expect(fullSignal).eql({
           '@timestamp': fullSignal['@timestamp'],
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/const_keyword.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/const_keyword.ts
index 7d1a4d01fe27c4..356234d61173db 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/const_keyword.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/const_keyword.ts
@@ -72,7 +72,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
         const hits = signalsOpen.hits.hits
-          .map((hit) => (hit._source.event as EventModule).dataset)
+          .map((hit) => (hit._source?.event as EventModule).dataset)
           .sort();
         expect(hits).to.eql([
           'dataset_name_1',
@@ -108,7 +108,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
         const hits = signalsOpen.hits.hits
-          .map((hit) => (hit._source.event as EventModule).dataset)
+          .map((hit) => (hit._source?.event as EventModule).dataset)
           .sort();
         expect(hits).to.eql([
           'dataset_name_1',
@@ -133,7 +133,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
         const hits = signalsOpen.hits.hits
-          .map((hit) => hit._source.signal.threshold_result ?? null)
+          .map((hit) => hit._source?.signal.threshold_result ?? null)
           .sort();
         expect(hits).to.eql([
           {
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword.ts
index fba13c95c66acc..59940bc0c4fd79 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword.ts
@@ -59,7 +59,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
         const hits = signalsOpen.hits.hits
-          .map((hit) => (hit._source.event as EventModule).dataset)
+          .map((hit) => (hit._source?.event as EventModule).dataset)
           .sort();
         expect(hits).to.eql([
           'dataset_name_1',
@@ -82,7 +82,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
         const hits = signalsOpen.hits.hits
-          .map((hit) => (hit._source.event as EventModule).dataset)
+          .map((hit) => (hit._source?.event as EventModule).dataset)
           .sort();
         expect(hits).to.eql([
           'dataset_name_1',
@@ -107,7 +107,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
         const hits = signalsOpen.hits.hits
-          .map((hit) => hit._source.signal.threshold_result ?? null)
+          .map((hit) => hit._source?.signal.threshold_result ?? null)
           .sort();
         expect(hits).to.eql([
           {
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword_mixed_with_const.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword_mixed_with_const.ts
index 2a354a83a10aee..9c32063c4378bb 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword_mixed_with_const.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword_mixed_with_const.ts
@@ -73,7 +73,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForSignalsToBePresent(supertest, 8, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
         const hits = signalsOpen.hits.hits
-          .map((hit) => (hit._source.event as EventModule).dataset)
+          .map((hit) => (hit._source?.event as EventModule).dataset)
           .sort();
         expect(hits).to.eql([
           'dataset_name_1',
@@ -113,7 +113,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForSignalsToBePresent(supertest, 8, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
         const hits = signalsOpen.hits.hits
-          .map((hit) => (hit._source.event as EventModule).dataset)
+          .map((hit) => (hit._source?.event as EventModule).dataset)
           .sort();
         expect(hits).to.eql([
           'dataset_name_1',
@@ -146,7 +146,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForSignalsToBePresent(supertest, 1, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
         const hits = signalsOpen.hits.hits
-          .map((hit) => hit._source.signal.threshold_result ?? null)
+          .map((hit) => hit._source?.signal.threshold_result ?? null)
           .sort();
         expect(hits).to.eql([
           {
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/open_close_signals.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/open_close_signals.ts
index d56463770e84f2..6768a76d85d45c 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/open_close_signals.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/open_close_signals.ts
@@ -6,8 +6,8 @@
  */
 
 import expect from '@kbn/expect';
+import type { estypes } from '@elastic/elasticsearch';
 
-import { SearchResponse } from 'elasticsearch';
 import { Signal } from '../../../../plugins/security_solution/server/lib/detection_engine/signals/types';
 import {
   DETECTION_ENGINE_SIGNALS_STATUS_URL,
@@ -95,11 +95,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForSignalsToBePresent(supertest, 10, [id]);
           const signalsOpen = await getSignalsByIds(supertest, [id]);
           const everySignalOpen = signalsOpen.hits.hits.every(
-            ({
-              _source: {
-                signal: { status },
-              },
-            }) => status === 'open'
+            (hit) => hit._source?.signal?.status === 'open'
           );
           expect(everySignalOpen).to.eql(true);
         });
@@ -123,7 +119,7 @@ export default ({ getService }: FtrProviderContext) => {
 
           const {
             body: signalsClosed,
-          }: { body: SearchResponse<{ signal: Signal }> } = await supertest
+          }: { body: estypes.SearchResponse<{ signal: Signal }> } = await supertest
             .post(DETECTION_ENGINE_QUERY_SIGNALS_URL)
             .set('kbn-xsrf', 'true')
             .send(getQuerySignalIds(signalIds))
@@ -150,18 +146,14 @@ export default ({ getService }: FtrProviderContext) => {
 
           const {
             body: signalsClosed,
-          }: { body: SearchResponse<{ signal: Signal }> } = await supertest
+          }: { body: estypes.SearchResponse<{ signal: Signal }> } = await supertest
             .post(DETECTION_ENGINE_QUERY_SIGNALS_URL)
             .set('kbn-xsrf', 'true')
             .send(getQuerySignalIds(signalIds))
             .expect(200);
 
           const everySignalClosed = signalsClosed.hits.hits.every(
-            ({
-              _source: {
-                signal: { status },
-              },
-            }) => status === 'closed'
+            (hit) => hit._source?.signal?.status === 'closed'
           );
           expect(everySignalClosed).to.eql(true);
         });
@@ -188,20 +180,16 @@ export default ({ getService }: FtrProviderContext) => {
           // to allow a check that the signals were NOT closed with t1 analyst
           const {
             body: signalsClosed,
-          }: { body: SearchResponse<{ signal: Signal }> } = await supertest
+          }: { body: estypes.SearchResponse<{ signal: Signal }> } = await supertest
             .post(DETECTION_ENGINE_QUERY_SIGNALS_URL)
             .set('kbn-xsrf', 'true')
             .send(getQuerySignalIds(signalIds))
             .expect(200);
 
-          const everySignalOpen = signalsClosed.hits.hits.every(
-            ({
-              _source: {
-                signal: { status },
-              },
-            }) => status === 'closed'
+          const everySignalClosed = signalsClosed.hits.hits.every(
+            (hit) => hit._source?.signal?.status === 'closed'
           );
-          expect(everySignalOpen).to.eql(true);
+          expect(everySignalClosed).to.eql(true);
 
           await deleteUserAndRole(getService, ROLES.t1_analyst);
         });
@@ -227,18 +215,14 @@ export default ({ getService }: FtrProviderContext) => {
 
           const {
             body: signalsClosed,
-          }: { body: SearchResponse<{ signal: Signal }> } = await supertest
+          }: { body: estypes.SearchResponse<{ signal: Signal }> } = await supertest
             .post(DETECTION_ENGINE_QUERY_SIGNALS_URL)
             .set('kbn-xsrf', 'true')
             .send(getQuerySignalIds(signalIds))
             .expect(200);
 
           const everySignalClosed = signalsClosed.hits.hits.every(
-            ({
-              _source: {
-                signal: { status },
-              },
-            }) => status === 'closed'
+            (hit) => hit._source?.signal?.status === 'closed'
           );
           expect(everySignalClosed).to.eql(true);
 
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/runtime.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/runtime.ts
index 0015a41f911d47..2b7c38c7753656 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/runtime.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/runtime.ts
@@ -47,7 +47,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((signal) => (signal._source.host as Runtime).name);
+        const hits = signalsOpen.hits.hits.map((signal) => (signal._source?.host as Runtime).name);
         expect(hits).to.eql(['host name 1', 'host name 2', 'host name 3', 'host name 4']);
       });
 
@@ -58,7 +58,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
         const hits = signalsOpen.hits.hits.map(
-          (signal) => (signal._source.host as Runtime).hostname
+          (signal) => (signal._source?.host as Runtime).hostname
         );
         expect(hits).to.eql(['host name 1', 'host name 2', 'host name 3', 'host name 4']);
       });
@@ -91,7 +91,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForRuleSuccessOrStatus(supertest, id);
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
-        const hits = signalsOpen.hits.hits.map((signal) => signal._source.host);
+        const hits = signalsOpen.hits.hits.map((signal) => signal._source?.host);
         expect(hits).to.eql([
           [
             {
@@ -140,7 +140,7 @@ export default ({ getService }: FtrProviderContext) => {
         await waitForSignalsToBePresent(supertest, 4, [id]);
         const signalsOpen = await getSignalsById(supertest, id);
         const hits = signalsOpen.hits.hits.map(
-          (signal) => (signal._source.host as Runtime).hostname
+          (signal) => (signal._source?.host as Runtime).hostname
         );
         expect(hits).to.eql([undefined, undefined, undefined, undefined]);
       });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/timestamps.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/timestamps.ts
index 2c304803ded897..28a2e6b4dbd5ca 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/timestamps.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/timestamps.ts
@@ -65,7 +65,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsByIds(supertest, [id]);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.signal.original_time).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.signal.original_time).sort();
           expect(hits).to.eql(['2021-06-02T23:33:15.000Z']);
         });
 
@@ -78,7 +78,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsByIds(supertest, [id]);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.signal.original_time).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.signal.original_time).sort();
           expect(hits).to.eql(['2020-12-16T15:16:18.000Z']);
         });
       });
@@ -90,7 +90,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsByIds(supertest, [id]);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.signal.original_time).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.signal.original_time).sort();
           expect(hits).to.eql(['2021-06-02T23:33:15.000Z']);
         });
 
@@ -103,7 +103,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForRuleSuccessOrStatus(supertest, id);
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsOpen = await getSignalsByIds(supertest, [id]);
-          const hits = signalsOpen.hits.hits.map((hit) => hit._source.signal.original_time).sort();
+          const hits = signalsOpen.hits.hits.map((hit) => hit._source?.signal.original_time).sort();
           expect(hits).to.eql(['2020-12-16T15:16:18.000Z']);
         });
       });
@@ -215,7 +215,7 @@ export default ({ getService }: FtrProviderContext) => {
           await waitForSignalsToBePresent(supertest, 1, [id]);
           const signalsResponse = await getSignalsByIds(supertest, [id, id]);
           const hits = signalsResponse.hits.hits
-            .map((hit) => hit._source.signal.original_time)
+            .map((hit) => hit._source?.signal.original_time)
             .sort();
           expect(hits).to.eql([undefined]);
         });
diff --git a/x-pack/test/detection_engine_api_integration/utils.ts b/x-pack/test/detection_engine_api_integration/utils.ts
index f8989c685c82c6..bd2ce12b6dcbec 100644
--- a/x-pack/test/detection_engine_api_integration/utils.ts
+++ b/x-pack/test/detection_engine_api_integration/utils.ts
@@ -7,11 +7,11 @@
 
 import { KbnClient } from '@kbn/test';
 import type { ApiResponse } from '@elastic/elasticsearch';
+import { Context } from '@elastic/elasticsearch/lib/Transport';
+import type { estypes } from '@elastic/elasticsearch';
 import type { KibanaClient } from '@elastic/elasticsearch/api/kibana';
 import { SuperTest } from 'supertest';
 import supertestAsPromised from 'supertest-as-promised';
-import { Context } from '@elastic/elasticsearch/lib/Transport';
-import { SearchResponse } from 'elasticsearch';
 import type {
   ListArray,
   NonEmptyEntriesArray,
@@ -1079,12 +1079,14 @@ export const getSignalsByRuleIds = async (
   supertest: SuperTest<supertestAsPromised.Test>,
   ruleIds: string[]
 ): Promise<
-  SearchResponse<{
+  estypes.SearchResponse<{
     signal: Signal;
     [x: string]: unknown;
   }>
 > => {
-  const { body: signalsOpen }: { body: SearchResponse<{ signal: Signal }> } = await supertest
+  const {
+    body: signalsOpen,
+  }: { body: estypes.SearchResponse<{ signal: Signal }> } = await supertest
     .post(DETECTION_ENGINE_QUERY_SIGNALS_URL)
     .set('kbn-xsrf', 'true')
     .send(getQuerySignalsRuleId(ruleIds))
@@ -1103,12 +1105,14 @@ export const getSignalsByIds = async (
   ids: string[],
   size?: number
 ): Promise<
-  SearchResponse<{
+  estypes.SearchResponse<{
     signal: Signal;
     [x: string]: unknown;
   }>
 > => {
-  const { body: signalsOpen }: { body: SearchResponse<{ signal: Signal }> } = await supertest
+  const {
+    body: signalsOpen,
+  }: { body: estypes.SearchResponse<{ signal: Signal }> } = await supertest
     .post(DETECTION_ENGINE_QUERY_SIGNALS_URL)
     .set('kbn-xsrf', 'true')
     .send(getQuerySignalsId(ids, size))
@@ -1125,12 +1129,14 @@ export const getSignalsById = async (
   supertest: SuperTest<supertestAsPromised.Test>,
   id: string
 ): Promise<
-  SearchResponse<{
+  estypes.SearchResponse<{
     signal: Signal;
     [x: string]: unknown;
   }>
 > => {
-  const { body: signalsOpen }: { body: SearchResponse<{ signal: Signal }> } = await supertest
+  const {
+    body: signalsOpen,
+  }: { body: estypes.SearchResponse<{ signal: Signal }> } = await supertest
     .post(DETECTION_ENGINE_QUERY_SIGNALS_URL)
     .set('kbn-xsrf', 'true')
     .send(getQuerySignalsId([id]))
diff --git a/x-pack/test/functional/apps/discover/index.ts b/x-pack/test/functional/apps/discover/index.ts
index 82f53929ada313..af117a21820347 100644
--- a/x-pack/test/functional/apps/discover/index.ts
+++ b/x-pack/test/functional/apps/discover/index.ts
@@ -19,5 +19,6 @@ export default function ({ loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./saved_searches'));
     loadTestFile(require.resolve('./visualize_field'));
     loadTestFile(require.resolve('./value_suggestions'));
+    loadTestFile(require.resolve('./value_suggestions_non_timebased'));
   });
 }
diff --git a/x-pack/test/functional/apps/discover/reporting.ts b/x-pack/test/functional/apps/discover/reporting.ts
index 3eb66204df5640..cb05a59f07917a 100644
--- a/x-pack/test/functional/apps/discover/reporting.ts
+++ b/x-pack/test/functional/apps/discover/reporting.ts
@@ -56,6 +56,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       it('remains available regardless of the saved search state', async () => {
         // create new search, csv export is not available
         await PageObjects.discover.clickNewSearchButton();
+        await PageObjects.reporting.setTimepickerInDataRange();
         await PageObjects.reporting.openCsvReportingPanel();
         expect(await PageObjects.reporting.isGenerateReportButtonDisabled()).to.be(null);
         // save search, csv export is available
diff --git a/x-pack/test/functional/apps/discover/value_suggestions.ts b/x-pack/test/functional/apps/discover/value_suggestions.ts
index 7d5f500992eb79..6d0047a27c7e3d 100644
--- a/x-pack/test/functional/apps/discover/value_suggestions.ts
+++ b/x-pack/test/functional/apps/discover/value_suggestions.ts
@@ -7,29 +7,127 @@
 
 import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../ftr_provider_context';
+import { UI_SETTINGS } from '../../../../../src/plugins/data/common';
 
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
   const queryBar = getService('queryBar');
-  const PageObjects = getPageObjects(['common', 'timePicker']);
+  const filterBar = getService('filterBar');
+  const docTable = getService('docTable');
+  const PageObjects = getPageObjects(['common', 'timePicker', 'settings', 'context']);
+
+  async function setAutocompleteUseTimeRange(value: boolean) {
+    await PageObjects.settings.navigateTo();
+    await PageObjects.settings.clickKibanaSettings();
+    await PageObjects.settings.toggleAdvancedSettingCheckbox(
+      UI_SETTINGS.AUTOCOMPLETE_USE_TIMERANGE,
+      value
+    );
+  }
 
   describe('value suggestions', function describeIndexTests() {
     before(async function () {
       await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/logstash_functional');
       await esArchiver.load('x-pack/test/functional/es_archives/dashboard/drilldowns');
-      await PageObjects.common.navigateToApp('discover');
-      await PageObjects.timePicker.setDefaultAbsoluteRange();
     });
 
     after(async () => {
       await esArchiver.unload('x-pack/test/functional/es_archives/dashboard/drilldowns');
     });
 
-    it('show up', async () => {
-      await queryBar.setQuery('extension.raw : ');
-      const suggestions = await queryBar.getSuggestions();
-      expect(suggestions.length).to.be(5);
-      expect(suggestions).to.contain('"jpg"');
+    describe('useTimeRange enabled', () => {
+      before(async () => {
+        await setAutocompleteUseTimeRange(true);
+      });
+
+      beforeEach(async () => {
+        await PageObjects.common.navigateToApp('discover');
+      });
+
+      describe('discover', () => {
+        afterEach(async () => {
+          await queryBar.clearQuery();
+        });
+
+        it('dont show up if outside of range', async () => {
+          await PageObjects.timePicker.setAbsoluteRange(
+            'Mar 1, 2020 @ 00:00:00.000',
+            'Nov 1, 2020 @ 00:00:00.000'
+          );
+
+          await queryBar.setQuery('extension.raw : ');
+          const suggestions = await queryBar.getSuggestions();
+          expect(suggestions.length).to.be(0);
+        });
+
+        it('show up if in range', async () => {
+          await PageObjects.timePicker.setDefaultAbsoluteRange();
+          await queryBar.setQuery('extension.raw : ');
+          const suggestions = await queryBar.getSuggestions();
+          expect(suggestions.length).to.be(5);
+          expect(suggestions).to.contain('"jpg"');
+        });
+      });
+
+      describe('context', () => {
+        after(async () => {
+          await filterBar.removeFilter('geo.dest');
+        });
+
+        it('shows all autosuggest options for a filter in discover context app', async () => {
+          // Set a good time range
+          await PageObjects.timePicker.setDefaultAbsoluteRange();
+
+          // navigate to context
+          await docTable.clickRowToggle({ rowIndex: 0 });
+          const rowActions = await docTable.getRowActions({ rowIndex: 0 });
+          await rowActions[0].click();
+          await PageObjects.context.waitUntilContextLoadingHasFinished();
+
+          // Apply filter in context view
+          await filterBar.addFilter('geo.dest', 'is', 'US');
+        });
+      });
+    });
+
+    describe('useTimeRange disabled', () => {
+      before(async () => {
+        await setAutocompleteUseTimeRange(false);
+      });
+
+      beforeEach(async () => {
+        await PageObjects.common.navigateToApp('discover');
+      });
+
+      afterEach(async () => {
+        await queryBar.clearQuery();
+      });
+
+      after(async () => {
+        await PageObjects.settings.navigateTo();
+        await PageObjects.settings.clickKibanaSettings();
+        await PageObjects.settings.clearAdvancedSettings(UI_SETTINGS.AUTOCOMPLETE_USE_TIMERANGE);
+      });
+
+      it('DO show up if outside of range', async () => {
+        await PageObjects.timePicker.setAbsoluteRange(
+          'Mar 1, 2020 @ 00:00:00.000',
+          'Nov 1, 2020 @ 00:00:00.000'
+        );
+
+        await queryBar.setQuery('extension.raw : ');
+        const suggestions = await queryBar.getSuggestions();
+        expect(suggestions.length).to.be(5);
+        expect(suggestions).to.contain('"jpg"');
+      });
+
+      it('show up', async () => {
+        await PageObjects.timePicker.setDefaultAbsoluteRange();
+        await queryBar.setQuery('extension.raw : ');
+        const suggestions = await queryBar.getSuggestions();
+        expect(suggestions.length).to.be(5);
+        expect(suggestions).to.contain('"jpg"');
+      });
     });
   });
 }
diff --git a/x-pack/test/functional/apps/discover/value_suggestions_non_timebased.ts b/x-pack/test/functional/apps/discover/value_suggestions_non_timebased.ts
new file mode 100644
index 00000000000000..cfddd33f4197e7
--- /dev/null
+++ b/x-pack/test/functional/apps/discover/value_suggestions_non_timebased.ts
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const queryBar = getService('queryBar');
+  const PageObjects = getPageObjects(['common', 'settings', 'context']);
+
+  describe('value suggestions non time based', function describeIndexTests() {
+    before(async function () {
+      await esArchiver.loadIfNeeded(
+        'test/functional/fixtures/es_archiver/index_pattern_without_timefield'
+      );
+    });
+
+    after(async () => {
+      await esArchiver.unload(
+        'test/functional/fixtures/es_archiver/index_pattern_without_timefield'
+      );
+    });
+
+    it('shows all autosuggest options for a filter in discover context app', async () => {
+      await PageObjects.common.navigateToApp('discover');
+
+      await queryBar.setQuery('type.keyword : ');
+      const suggestions = await queryBar.getSuggestions();
+      expect(suggestions.length).to.be(1);
+      expect(suggestions).to.contain('"apache"');
+    });
+  });
+}
diff --git a/x-pack/test/functional/apps/index_patterns/feature_controls/index_patterns_security.ts b/x-pack/test/functional/apps/index_patterns/feature_controls/index_patterns_security.ts
index 52fcac769955c5..c1610ebe0709f2 100644
--- a/x-pack/test/functional/apps/index_patterns/feature_controls/index_patterns_security.ts
+++ b/x-pack/test/functional/apps/index_patterns/feature_controls/index_patterns_security.ts
@@ -133,7 +133,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
       it(`index pattern listing doesn't show create button`, async () => {
         await PageObjects.settings.clickKibanaIndexPatterns();
         await testSubjects.existOrFail('emptyIndexPatternPrompt');
-        await testSubjects.missingOrFail('createIndexPatternButton');
+        await testSubjects.missingOrFail('createIndexPatternButtonFlyout');
       });
 
       it(`shows read-only badge`, async () => {
diff --git a/x-pack/test/functional/apps/lens/dashboard.ts b/x-pack/test/functional/apps/lens/dashboard.ts
index 095b1ae7c2f0f5..a2654563c546d1 100644
--- a/x-pack/test/functional/apps/lens/dashboard.ts
+++ b/x-pack/test/functional/apps/lens/dashboard.ts
@@ -132,6 +132,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     it('should not carry over filters if creating a new lens visualization from within dashboard', async () => {
       await PageObjects.common.navigateToApp('dashboard');
       await PageObjects.dashboard.clickNewDashboard();
+      await PageObjects.timePicker.setDefaultAbsoluteRange();
       await filterBar.addFilter('geo.src', 'is', 'US');
       await filterBar.toggleFilterPinned('geo.src');
       await filterBar.addFilter('geo.dest', 'is', 'LS');
diff --git a/x-pack/test/functional/apps/management/create_index_pattern_wizard.js b/x-pack/test/functional/apps/management/create_index_pattern_wizard.js
index 246256cb4c2a1d..445e340d236e69 100644
--- a/x-pack/test/functional/apps/management/create_index_pattern_wizard.js
+++ b/x-pack/test/functional/apps/management/create_index_pattern_wizard.js
@@ -43,7 +43,7 @@ export default function ({ getService, getPageObjects }) {
           method: 'PUT',
         });
 
-        await PageObjects.settings.createIndexPattern('test_data_stream', false);
+        await PageObjects.settings.createIndexPattern('test_data_stream');
 
         await es.transport.request({
           path: '/_data_stream/test_data_stream',
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/annotations.ts b/x-pack/test/functional/apps/ml/anomaly_detection/annotations.ts
index a6ea27be21cc84..d2f9acf35d6323 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/annotations.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/annotations.ts
@@ -116,7 +116,7 @@ export default function ({ getService }: FtrProviderContext) {
       };
 
       before(async () => {
-        await ml.api.indexAnnotation(annotation, annotationId);
+        await ml.api.indexAnnotation(annotation as Partial<Annotation>, annotationId);
       });
 
       it('displays the original annotation correctly', async () => {
@@ -189,7 +189,7 @@ export default function ({ getService }: FtrProviderContext) {
       const annotationId = `delete-annotation-id-${Date.now()}`;
 
       before(async () => {
-        await ml.api.indexAnnotation(annotation, annotationId);
+        await ml.api.indexAnnotation(annotation as Partial<Annotation>, annotationId);
       });
 
       it('displays the original annotation', async () => {
diff --git a/x-pack/test/functional/apps/rollup_job/hybrid_index_pattern.js b/x-pack/test/functional/apps/rollup_job/hybrid_index_pattern.js
index 1986efe202224b..e479c6729d8c38 100644
--- a/x-pack/test/functional/apps/rollup_job/hybrid_index_pattern.js
+++ b/x-pack/test/functional/apps/rollup_job/hybrid_index_pattern.js
@@ -12,7 +12,6 @@ import mockRolledUpData, { mockIndices } from './hybrid_index_helper';
 export default function ({ getService, getPageObjects }) {
   const es = getService('es');
   const esArchiver = getService('esArchiver');
-  const find = getService('find');
   const retry = getService('retry');
   const PageObjects = getPageObjects(['common', 'settings']);
   const esDeleteAllIndices = getService('esDeleteAllIndices');
@@ -91,10 +90,6 @@ export default function ({ getService, getPageObjects }) {
       );
       expect(filteredIndexPatternNames.length).to.be(1);
 
-      // make sure there are no toasts which might be showing unexpected errors
-      const toastShown = await find.existsByCssSelector('.euiToast');
-      expect(toastShown).to.be(false);
-
       // ensure all fields are available
       await PageObjects.settings.clickIndexPatternByName(rollupIndexPatternName);
       const fields = await PageObjects.settings.getFieldNames();
diff --git a/x-pack/test/functional/es_archives/discover/default/data.json.gz b/x-pack/test/functional/es_archives/discover/default/data.json.gz
deleted file mode 100644
index 047d890f6d4101..00000000000000
Binary files a/x-pack/test/functional/es_archives/discover/default/data.json.gz and /dev/null differ
diff --git a/x-pack/test/functional/es_archives/discover/default/mappings.json b/x-pack/test/functional/es_archives/discover/default/mappings.json
deleted file mode 100644
index 519af2dd75b9e1..00000000000000
--- a/x-pack/test/functional/es_archives/discover/default/mappings.json
+++ /dev/null
@@ -1,279 +0,0 @@
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      ".kibana": {}
-    },
-    "index": ".kibana_1",
-    "mappings": {
-      "properties": {
-        "config": {
-          "dynamic": "true",
-          "properties": {
-            "buildNum": {
-              "type": "keyword"
-            }
-          }
-        },
-        "dashboard": {
-          "dynamic": "strict",
-          "properties": {
-            "description": {
-              "type": "text"
-            },
-            "hits": {
-              "type": "integer"
-            },
-            "kibanaSavedObjectMeta": {
-              "properties": {
-                "searchSourceJSON": {
-                  "type": "text"
-                }
-              }
-            },
-            "optionsJSON": {
-              "type": "text"
-            },
-            "panelsJSON": {
-              "type": "text"
-            },
-            "refreshInterval": {
-              "properties": {
-                "display": {
-                  "type": "keyword"
-                },
-                "pause": {
-                  "type": "boolean"
-                },
-                "section": {
-                  "type": "integer"
-                },
-                "value": {
-                  "type": "integer"
-                }
-              }
-            },
-            "timeFrom": {
-              "type": "keyword"
-            },
-            "timeRestore": {
-              "type": "boolean"
-            },
-            "timeTo": {
-              "type": "keyword"
-            },
-            "title": {
-              "type": "text"
-            },
-            "uiStateJSON": {
-              "type": "text"
-            },
-            "version": {
-              "type": "integer"
-            }
-          }
-        },
-        "index-pattern": {
-          "dynamic": "strict",
-          "properties": {
-            "fieldFormatMap": {
-              "type": "text"
-            },
-            "fields": {
-              "type": "text"
-            },
-            "intervalName": {
-              "type": "keyword"
-            },
-            "notExpandable": {
-              "type": "boolean"
-            },
-            "sourceFilters": {
-              "type": "text"
-            },
-            "timeFieldName": {
-              "type": "keyword"
-            },
-            "title": {
-              "type": "text"
-            },
-            "fieldAttrs": {
-              "type": "text"
-            }
-          }
-        },
-        "search": {
-          "dynamic": "strict",
-          "properties": {
-            "columns": {
-              "type": "keyword"
-            },
-            "description": {
-              "type": "text"
-            },
-            "hits": {
-              "type": "integer"
-            },
-            "kibanaSavedObjectMeta": {
-              "properties": {
-                "searchSourceJSON": {
-                  "type": "text"
-                }
-              }
-            },
-            "sort": {
-              "type": "keyword"
-            },
-            "title": {
-              "type": "text"
-            },
-            "version": {
-              "type": "integer"
-            }
-          }
-        },
-        "server": {
-          "dynamic": "strict",
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            }
-          }
-        },
-        "timelion-sheet": {
-          "dynamic": "strict",
-          "properties": {
-            "description": {
-              "type": "text"
-            },
-            "hits": {
-              "type": "integer"
-            },
-            "kibanaSavedObjectMeta": {
-              "properties": {
-                "searchSourceJSON": {
-                  "type": "text"
-                }
-              }
-            },
-            "timelion_chart_height": {
-              "type": "integer"
-            },
-            "timelion_columns": {
-              "type": "integer"
-            },
-            "timelion_interval": {
-              "type": "keyword"
-            },
-            "timelion_other_interval": {
-              "type": "keyword"
-            },
-            "timelion_rows": {
-              "type": "integer"
-            },
-            "timelion_sheet": {
-              "type": "text"
-            },
-            "title": {
-              "type": "text"
-            },
-            "version": {
-              "type": "integer"
-            }
-          }
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "url": {
-          "dynamic": "strict",
-          "properties": {
-            "accessCount": {
-              "type": "long"
-            },
-            "accessDate": {
-              "type": "date"
-            },
-            "createDate": {
-              "type": "date"
-            },
-            "url": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 2048,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            }
-          }
-        },
-        "visualization": {
-          "dynamic": "strict",
-          "properties": {
-            "description": {
-              "type": "text"
-            },
-            "kibanaSavedObjectMeta": {
-              "properties": {
-                "searchSourceJSON": {
-                  "type": "text"
-                }
-              }
-            },
-            "savedSearchId": {
-              "type": "keyword"
-            },
-            "title": {
-              "type": "text"
-            },
-            "uiStateJSON": {
-              "type": "text"
-            },
-            "version": {
-              "type": "integer"
-            },
-            "visState": {
-              "type": "text"
-            }
-          }
-        },
-        "query": {
-          "properties": {
-            "title": {
-              "type": "text"
-            },
-            "description": {
-              "type": "text"
-            },
-            "query": {
-              "properties": {
-                "language": {
-                  "type": "keyword"
-                },
-                "query": {
-                  "type": "keyword",
-                  "index": false
-                }
-              }
-            },
-            "filters": {
-              "type": "object",
-              "enabled": false
-            },
-            "timefilter": {
-              "type": "object",
-              "enabled": false
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "number_of_replicas": "1",
-        "number_of_shards": "1"
-      }
-    }
-  }
-}
diff --git a/x-pack/test/functional/fixtures/kbn_archiver/discover/default.json b/x-pack/test/functional/fixtures/kbn_archiver/discover/default.json
new file mode 100644
index 00000000000000..2b0d414c67c990
--- /dev/null
+++ b/x-pack/test/functional/fixtures/kbn_archiver/discover/default.json
@@ -0,0 +1,65 @@
+{
+  "attributes": {
+    "buildNum": 9007199254740991
+  },
+  "coreMigrationVersion": "7.15.0",
+  "id": "7.15.0",
+  "migrationVersion": {
+    "config": "7.13.0"
+  },
+  "references": [],
+  "type": "config",
+  "updated_at": "2021-08-04T16:20:48.415Z",
+  "version": "WzUsMl0="
+}
+
+{
+  "attributes": {
+    "fields": "[{\"name\":\"referer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:image:width\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"xss.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"headings.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"meta.user.lastname\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.article:tag.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"geo.dest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.twitter:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.article:section.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"utc_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.twitter:card\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"meta.char\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"clientip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:image:height\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"machine.ram\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"links\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"@tags.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"phpmemory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.twitter:card.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.article:modified_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:site_name.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"request.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.article:tag\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"agent.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"spaces\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:site.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"headings\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false},{\"name\":\"relatedContent.og:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"request\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"index.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"extension\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false},{\"name\":\"relatedContent.twitter:site\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"geo.coordinates\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"meta.related\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"response.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"@message.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"machine.os\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.article:section\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"xss\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"links.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"geo.srcdest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"extension.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"machine.os.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"@tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"host.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:type.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"geo.src\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"spaces.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:image:height.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:site_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"@message\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"response\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"meta.user.firstname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:image:width.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.article:published_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false},{\"name\":\"nestedField.child\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true,\"subType\":{\"nested\":{\"path\":\"nestedField\"}}}]",
+    "timeFieldName": "@timestamp",
+    "title": "logstash-*"
+  },
+  "coreMigrationVersion": "7.15.0",
+  "id": "logstash-*",
+  "migrationVersion": {
+    "index-pattern": "7.11.0"
+  },
+  "references": [],
+  "type": "index-pattern",
+  "version": "WzIsMl0="
+}
+
+{
+  "attributes": {
+    "columns": [
+      "_source"
+    ],
+    "description": "A Saved Search Description",
+    "hits": 0,
+    "kibanaSavedObjectMeta": {
+      "searchSourceJSON": "{\"highlightAll\":true,\"filter\":[],\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
+    },
+    "sort": [
+      [
+        "@timestamp",
+        "desc"
+      ]
+    ],
+    "title": "A Saved Search",
+    "version": 1
+  },
+  "coreMigrationVersion": "7.15.0",
+  "id": "ab12e3c0-f231-11e6-9486-733b1ac9221a",
+  "migrationVersion": {
+    "search": "7.9.3"
+  },
+  "references": [
+    {
+      "id": "logstash-*",
+      "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
+      "type": "index-pattern"
+    }
+  ],
+  "type": "search",
+  "version": "WzMsMl0="
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/page_objects/index_lifecycle_management_page.ts b/x-pack/test/functional/page_objects/index_lifecycle_management_page.ts
index 6706579d5c399c..b9cfebfbbb40b5 100644
--- a/x-pack/test/functional/page_objects/index_lifecycle_management_page.ts
+++ b/x-pack/test/functional/page_objects/index_lifecycle_management_page.ts
@@ -79,7 +79,7 @@ export function IndexLifecycleManagementPageProvider({ getService }: FtrProvider
 
     async increasePolicyListPageSize() {
       await testSubjects.click('tablePaginationPopoverButton');
-      await testSubjects.click(`tablePagination-100-rows`);
+      await testSubjects.click(`tablePagination-50-rows`);
     },
 
     async getPolicyRow(name: string) {
diff --git a/x-pack/test/functional/page_objects/security_page.ts b/x-pack/test/functional/page_objects/security_page.ts
index 074ecafddf3810..37fe0eccea31af 100644
--- a/x-pack/test/functional/page_objects/security_page.ts
+++ b/x-pack/test/functional/page_objects/security_page.ts
@@ -485,10 +485,7 @@ export class SecurityPageObject extends FtrService {
 
     if (roleObj.elasticsearch.indices[0].query) {
       await this.testSubjects.click('restrictDocumentsQuery0');
-      await this.monacoEditor.setCodeEditorValue(
-        0,
-        JSON.stringify(roleObj.elasticsearch.indices[0].query)
-      );
+      await this.monacoEditor.setCodeEditorValue(roleObj.elasticsearch.indices[0].query);
     }
 
     const globalPrivileges = (roleObj.kibana as any).global;
diff --git a/x-pack/test/plugin_functional/plugins/timelines_test/public/applications/timelines_test/index.tsx b/x-pack/test/plugin_functional/plugins/timelines_test/public/applications/timelines_test/index.tsx
index 3e5d0cab55a5fa..317010aca24bda 100644
--- a/x-pack/test/plugin_functional/plugins/timelines_test/public/applications/timelines_test/index.tsx
+++ b/x-pack/test/plugin_functional/plugins/timelines_test/public/applications/timelines_test/index.tsx
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { AlertConsumers } from '@kbn/rule-data-utils/target/alerts_as_data_rbac';
 import { Router } from 'react-router-dom';
 import React, { useCallback, useRef } from 'react';
 import ReactDOM from 'react-dom';
@@ -37,6 +38,7 @@ export function renderApp(
     ReactDOM.unmountComponentAtNode(parameters.element);
   };
 }
+const ALERT_CONSUMER = [AlertConsumers.SIEM];
 
 const AppRoot = React.memo(
   ({
@@ -61,6 +63,7 @@ const AppRoot = React.memo(
             {(timelinesPluginSetup &&
               timelinesPluginSetup.getTGrid &&
               timelinesPluginSetup.getTGrid<'standalone'>({
+                alertConsumers: ALERT_CONSUMER,
                 type: 'standalone',
                 columns: [],
                 indexNames: [],
diff --git a/x-pack/test/search_sessions_integration/tests/apps/discover/async_search.ts b/x-pack/test/search_sessions_integration/tests/apps/discover/async_search.ts
index 93dca78b34a826..3f02e64056325d 100644
--- a/x-pack/test/search_sessions_integration/tests/apps/discover/async_search.ts
+++ b/x-pack/test/search_sessions_integration/tests/apps/discover/async_search.ts
@@ -25,15 +25,23 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   ]);
   const searchSessions = getService('searchSessions');
   const retry = getService('retry');
+  const kibanaServer = getService('kibanaServer');
 
   describe('discover async search', () => {
     before(async () => {
       await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/logstash_functional');
-      await esArchiver.load('x-pack/test/functional/es_archives/discover/default');
+      await kibanaServer.importExport.load(
+        'x-pack/test/functional/fixtures/kbn_archiver/discover/default'
+      );
       await PageObjects.common.navigateToApp('discover');
       await PageObjects.timePicker.setDefaultAbsoluteRange();
       await PageObjects.header.waitUntilLoadingHasFinished();
     });
+    after(async () => {
+      await kibanaServer.importExport.unload(
+        'x-pack/test/functional/fixtures/kbn_archiver/discover/default'
+      );
+    });
 
     it('search session id should change between searches', async () => {
       const searchSessionId1 = await getSearchSessionId();
diff --git a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
index 9f57d7aa7a93a4..ba046a081b6d86 100644
--- a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
+++ b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
@@ -299,22 +299,32 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
                 logging: { file: 'info' },
                 advanced: { agent: { connection_delay: 'true' } },
                 malware: { mode: 'prevent' },
+                behavior_protection: { mode: 'prevent', supported: true },
                 popup: {
                   malware: {
                     enabled: true,
                     message: 'Elastic Security {action} {filename}',
                   },
+                  behavior_protection: {
+                    enabled: true,
+                    message: 'Elastic Security {action} {filename}',
+                  },
                 },
               },
               mac: {
                 events: { file: false, network: true, process: true },
                 logging: { file: 'info' },
                 malware: { mode: 'prevent' },
+                behavior_protection: { mode: 'prevent', supported: true },
                 popup: {
                   malware: {
                     enabled: true,
                     message: 'Elastic Security {action} {filename}',
                   },
+                  behavior_protection: {
+                    enabled: true,
+                    message: 'Elastic Security {action} {filename}',
+                  },
                 },
               },
               windows: {
@@ -513,22 +523,32 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
                 logging: { file: 'info' },
                 advanced: { agent: { connection_delay: 'true' } },
                 malware: { mode: 'prevent' },
+                behavior_protection: { mode: 'prevent', supported: true },
                 popup: {
                   malware: {
                     enabled: true,
                     message: 'Elastic Security {action} {filename}',
                   },
+                  behavior_protection: {
+                    enabled: true,
+                    message: 'Elastic Security {action} {filename}',
+                  },
                 },
               },
               mac: {
                 events: { file: true, network: true, process: true },
                 logging: { file: 'info' },
                 malware: { mode: 'prevent' },
+                behavior_protection: { mode: 'prevent', supported: true },
                 popup: {
                   malware: {
                     enabled: true,
                     message: 'Elastic Security {action} {filename}',
                   },
+                  behavior_protection: {
+                    enabled: true,
+                    message: 'Elastic Security {action} {filename}',
+                  },
                 },
               },
               windows: {
@@ -724,22 +744,32 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
                 events: { file: true, network: true, process: true },
                 logging: { file: 'info' },
                 malware: { mode: 'prevent' },
+                behavior_protection: { mode: 'prevent', supported: true },
                 popup: {
                   malware: {
                     enabled: true,
                     message: 'Elastic Security {action} {filename}',
                   },
+                  behavior_protection: {
+                    enabled: true,
+                    message: 'Elastic Security {action} {filename}',
+                  },
                 },
               },
               mac: {
                 events: { file: true, network: true, process: true },
                 logging: { file: 'info' },
                 malware: { mode: 'prevent' },
+                behavior_protection: { mode: 'prevent', supported: true },
                 popup: {
                   malware: {
                     enabled: true,
                     message: 'Elastic Security {action} {filename}',
                   },
+                  behavior_protection: {
+                    enabled: true,
+                    message: 'Elastic Security {action} {filename}',
+                  },
                 },
               },
               windows: {
diff --git a/yarn.lock b/yarn.lock
index 60aa5ebbd48cf2..7f42fc1902b11d 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1389,10 +1389,10 @@
   dependencies:
     object-hash "^1.3.0"
 
-"@elastic/charts@33.1.0":
-  version "33.1.0"
-  resolved "https://registry.yarnpkg.com/@elastic/charts/-/charts-33.1.0.tgz#3d32a0cf2d07a8df381a8a218104f0f554d392f0"
-  integrity sha512-m/Qvs2xixzkYa7LeNCKajHjfRIkT2ZTlEQ+Sw52eRt0enCXjuS8Pp6PvLz0a9Ye37aLCZhEJMAS1EGJxHsX/pQ==
+"@elastic/charts@33.2.0":
+  version "33.2.0"
+  resolved "https://registry.yarnpkg.com/@elastic/charts/-/charts-33.2.0.tgz#2135e86bfdde9796b64c8e58d29b0b193ddf47a9"
+  integrity sha512-Wk7IbfbxncAznTgMO5crRut7cS2GW8e8k++sg23epa6sT4RAnWwsKsvBojQdx9IvTWYxa+YJt4e7wCs3m5MSfw==
   dependencies:
     "@popperjs/core" "^2.4.0"
     chroma-js "^2.1.0"
@@ -1433,10 +1433,10 @@
   dependencies:
     "@elastic/ecs-helpers" "^1.1.0"
 
-"@elastic/elasticsearch@npm:@elastic/elasticsearch-canary@^8.0.0-canary.13":
-  version "8.0.0-canary.13"
-  resolved "https://registry.yarnpkg.com/@elastic/elasticsearch-canary/-/elasticsearch-canary-8.0.0-canary.13.tgz#bb5c71440411703364701eabae7960c8899d2012"
-  integrity sha512-QbwwpOqnarG469fIJw9VL+PTs4WLHl5M6OsEZA3IqQOlMfjtXEMdC0dRQoVz8UCcDW1rp+r87QPDkMneCFxFKg==
+"@elastic/elasticsearch@npm:@elastic/elasticsearch-canary@^8.0.0-canary.14":
+  version "8.0.0-canary.14"
+  resolved "https://registry.yarnpkg.com/@elastic/elasticsearch-canary/-/elasticsearch-canary-8.0.0-canary.14.tgz#36f0dedc5e02c43a2fd1ceb86e273e29c603f1fb"
+  integrity sha512-ZwyjT16581grvJLgsbkT9tzy49g5E2qYQ05mS41Db98Kqe0sYZsm25eHGuV7U9DqJo5LuV0TTTs3rhsaqL5Mhw==
   dependencies:
     debug "^4.3.1"
     hpagent "^0.1.1"
@@ -1466,10 +1466,10 @@
   resolved "https://registry.yarnpkg.com/@elastic/eslint-plugin-eui/-/eslint-plugin-eui-0.0.2.tgz#56b9ef03984a05cc213772ae3713ea8ef47b0314"
   integrity sha512-IoxURM5zraoQ7C8f+mJb9HYSENiZGgRVcG4tLQxE61yHNNRDXtGDWTZh8N1KIHcsqN1CEPETjuzBXkJYF/fDiQ==
 
-"@elastic/eui@36.0.0":
-  version "36.0.0"
-  resolved "https://registry.yarnpkg.com/@elastic/eui/-/eui-36.0.0.tgz#ebb180e859fd86171b5f84d08f8c958bb659b1cd"
-  integrity sha512-VLwtHZp3Qdj+vWR8wSNwxEYpGtJIdiErq0/PBsg83HDfz4KwgEveSI6STwODLgiUDr/YnpDhawuz+HU3JpfXRg==
+"@elastic/eui@36.1.0":
+  version "36.1.0"
+  resolved "https://registry.yarnpkg.com/@elastic/eui/-/eui-36.1.0.tgz#99946e193bc9d1616f52cbd16e1a5bc196bd450f"
+  integrity sha512-j09Kv5K9YBkb9NkM3+cGparJeYfjLfwyypG27UYvSOLCpOYxS3bPycwmD7QrzPjoTqH+HHzDanHSwJMp6ttabA==
   dependencies:
     "@types/chroma-js" "^2.0.0"
     "@types/lodash" "^4.14.160"
@@ -1506,7 +1506,7 @@
     text-diff "^1.0.1"
     unified "^9.2.0"
     unist-util-visit "^2.0.3"
-    url-parse "^1.5.0"
+    url-parse "^1.5.3"
     uuid "^8.3.0"
     vfile "^4.2.0"
 
@@ -28134,7 +28134,7 @@ url-parse-lax@^3.0.0:
   dependencies:
     prepend-http "^2.0.0"
 
-url-parse@^1.4.3, url-parse@^1.5.0:
+url-parse@^1.4.3, url-parse@^1.5.3:
   version "1.5.3"
   resolved "https://registry.yarnpkg.com/url-parse/-/url-parse-1.5.3.tgz#71c1303d38fb6639ade183c2992c8cc0686df862"
   integrity sha512-IIORyIQD9rvj0A4CLWsHkBBJuNqWpFQe224b6j9t/ABmquIS0qDU2pY6kl6AuOrL5OkCXHMCFNe1jBcuAggjvQ==