Merge branch 'master' into alerting/encodeURIComponent

.backportrc.json

@@ -3,6 +3,7 @@
   "targetBranchChoices": [
     { "name": "master", "checked": true },
     { "name": "7.x", "checked": true },
+    "7.13",
     "7.12",
     "7.11",
     "7.10",
@@ -30,7 +31,7 @@
   "targetPRLabels": ["backport"],
   "branchLabelMapping": {
     "^v8.0.0$": "master",
-    "^v7.13.0$": "7.x",
+    "^v7.14.0$": "7.x",
     "^v(\\d+).(\\d+).\\d+$": "$1.$2"
   },
   "autoMerge": true,

.eslintignore

@@ -1,5 +1,4 @@
 **/*.js.snap
-**/graphql/types.ts
 /.es
 /.chromium
 /build

docs/management/index-patterns.asciidoc → docs/concepts/index-patterns.asciidoc

@@ -1,5 +1,5 @@
 [[index-patterns]]
-== Create an index pattern
+=== Create an index pattern
 
 {kib} requires an index pattern to access the {es} data that you want to explore.
 An index pattern selects the data to use and allows you to define properties of the fields.
@@ -126,7 +126,7 @@ pattern:
 ```
 
 You can use exclusions to exclude indices that might contain mapping errors.
-To match indices starting with `logstash-`, and exclude those starting with `logstash-old` from 
+To match indices starting with `logstash-`, and exclude those starting with `logstash-old` from
 all clusters having a name starting with `cluster_`, you can use `cluster_*:logstash-*,cluster*:logstash-old*`.
 To exclude a cluster, use `cluster_*:logstash-*,cluster_one:-*`.
 
@@ -152,7 +152,7 @@ move between {kib} apps.
 image:management/index-patterns/images/new-index-pattern.png["Create index pattern"]
 
 [float]
-==== Format the display of common field types
+=== Format the display of common field types
 
 Whenever possible, {kib} uses the same field type for display as
 {es}. However, some field types that {es} supports are not available

docs/concepts/index.asciidoc

@@ -1,5 +1,5 @@
 [[kibana-concepts-analysts]]
-== {kib} concepts for analysts
+== {kib} concepts
 **_Learn the shared concepts for analyzing and visualizing your data_**
 
 As an analyst, you will use a combination of {kib} apps to analyze and
@@ -65,7 +65,7 @@ Each app in {kib} provides a time filter, and most apps also include semi-struct
 image:concepts/images/top-bar.png["Time filter, semi-structured search, and filters in a {kib} app"]
 
 If you frequently use any of the search options, you can click the
-save icon
+save query icon
 image:concepts/images/save-icon.png["save icon"] next to the
 semi-structured search to save or load a previously saved query.
 The saved query will always contain the semi-structured search query,
@@ -127,6 +127,7 @@ filters is combined with AND logic on the rest of the query.
 [role="screenshot"]
 image:concepts/images/add-filter-popup.png["Add filter popup"]
 
+
 [float]
 === Saving objects
 {kib} lets you save objects for your own future use or for sharing with others.
@@ -147,3 +148,14 @@ Use the global search to quickly open a saved object.
 
 * Try the {kib} <<get-started,Quick start>>, which shows you how to put these concepts into action.
 * Go to <<discover, Discover>> for instructions on searching your data.
+
+
+include::index-patterns.asciidoc[]
+
+include::set-time-filter.asciidoc[]
+
+include::kuery.asciidoc[]
+
+include::lucene.asciidoc[]
+
+include::save-query.asciidoc[]

docs/concepts/lucene.asciidoc

@@ -0,0 +1,51 @@
+[[lucene-query]]
+=== Lucene query syntax
+Lucene query syntax is available to {kib} users who opt out of the <<kuery-query>>.
+Full documentation for this syntax is available as part of {es}
+{ref}/query-dsl-query-string-query.html#query-string-syntax[query string syntax].
+
+The main reason to use the Lucene query syntax in {kib} is for advanced
+Lucene features, such as regular expressions or fuzzy term matching. However,
+Lucene syntax is not able to search nested objects or scripted fields.
+
+To perform a free text search, simply enter a text string. For example, if
+you're searching web server logs, you could enter `safari` to search all
+fields:
+
+[source,yaml]
+-------------------
+safari
+-------------------
+
+To search for a value in a specific field, prefix the value with the name
+of the field:
+
+[source,yaml]
+-------------------
+status:200
+-------------------
+
+To search for a range of values, use the bracketed range syntax,
+`[START_VALUE TO END_VALUE]`. For example, to find entries that have 4xx
+status codes, you could enter `status:[400 TO 499]`.
+
+[source,yaml]
+-------------------
+status:[400 TO 499]
+-------------------
+
+For an open range, use a wildcard:
+
+[source,yaml]
+-------------------
+status:[400 TO *]
+-------------------
+
+To specify more complex search criteria, use the boolean operators
+`AND`, `OR`, and `NOT`. For example, to find entries that have 4xx status
+codes and have an extension of `php` or `html`:
+
+[source,yaml]
+-------------------
+status:[400 TO 499] AND (extension:php OR extension:html)
+-------------------

docs/concepts/save-query.asciidoc

@@ -1,39 +1,45 @@
 [[save-load-delete-query]]
-== Save a query
-A saved query is a collection of query text and filters that you can
-reuse in any app with a query bar, like <<discover, *Discover*>> and <<dashboard, *Dashboard*>>. Save a query when you want to:
+=== Save a query
 
-* Retrieve results from the same query at a later time without having to reenter the query text, add the filters or set the time filter
-* View the results of the same query in multiple apps
-* Share your query
+Have you ever built a query that you wanted to reuse?
+With saved queries, you can save your query text, filters, and time range for
+reuse anywhere a query bar is present.
 
-Saved queries don't include information specific to *Discover*,
-such as the currently selected columns in the document table, the sort order, and the index pattern.
-To save your current view of *Discover* for later retrieval and reuse,
-create a <<save-open-search, saved search>> instead.
+For example, suppose you're in *Discover*, and you've put time into building
+a query that includes query input text, multiple filters, and a specific time range.
+Save this query, and you can embed the search results in dashboards,
+use them as a foundation for building a visualization,
+and share them in a link or CVS form.
+
+[role="screenshot"]
+image:concepts/images/saved-query.png["Example of the saved query management popover with a list of saved queries"]
 
-NOTE::
 
-If you have insufficient privileges to save queries, the *Save current query*
-button isn't visible in the saved query management popover.
+Saved queries are different than <<save-open-search,saved searches>>,
+which include the *Discover* configuration&mdash;selected columns in the document table, sort order, and
+index pattern&mdash;in addition to the query.
+Saved searches are primarily used for adding search results to a dashboard.
+
+[role="xpack"]
+==== Read-only access
+If you have insufficient privileges to save queries,
+the *Save* button isn't visible in the saved query management popover.
 For more information, see <<xpack-security-authorization, Granting access to Kibana>>
 
-. Click *#* in the query bar.
+==== Save a query
+
+. Once you’ve built a query worth saving, click the save query icon image:concepts/images/save-icon.png["save query icon"].
 . In the popover, click *Save current query*.
-+
-[role="screenshot"]
-image::discover/images/saved-query-management-component-all-privileges.png["Example of the saved query management popover with a list of saved queries with write access",width="80%"]
-+
-. Enter a name, a description, and then select the filter options.
+. Enter a unique name to identify the query and an optional description that will appear in a tooltip in the saved query popover.
+. Choose whether to include or exclude filters and a time range.
 By default, filters are automatically included, but the time filter is not.
 +
 [role="screenshot"]
-image::discover/images/saved-query-save-form-default-filters.png["Example of the saved query management save form with the filters option included and the time filter option excluded",width="80%"]
+image:concepts/images/saved-query-popup.png["Example of the saved query management popover with a list of saved queries"]
+
 . Click *Save*.
-. To load a saved query into *Discover* or *Dashboard*, open the *Saved search* popover, and select the query.
-. To manage your saved queries, use these actions in the popover:
+. To load a saved query, select it in the *Saved query* popover.
 +
-* Save as new:  Save changes to the current query.
-* Clear.  Clear a query that is currently loaded in an app.
-* Delete.  You can’t recover a deleted query.
-. To import and export saved queries, go to <<managing-saved-objects, Saved Objects in Management>>.
+The query text, filters, and time range are updated and your data refreshed.
+If you’re loading a saved query that did not include the filters or time range, those components remain as-is.
+. To clear, modify, and delete saved queries, use the *Saved query* popover.

docs/concepts/set-time-filter.asciidoc

@@ -0,0 +1,31 @@
+[[set-time-filter]]
+=== Set the time range
+Display data within a
+specified time range when your index contains time-based events, and a time-field is configured for the
+selected <<index-patterns, index pattern>>.
+The default time range is 15 minutes, but you can customize
+it in <<advanced-options,Advanced Settings>>.
+
+. Click image:concepts/images/time-filter-icon.png[clock icon].
+
+. Choose one of the following:
+
+* *Quick select* to use a recent time range, then use the back and forward
+  arrows to move through the time ranges.
+
+* *Commonly used* to use a time range from options such as *Last 15 minutes*,
+  *Today*, and *Week to date*.
+
+* *Recently used date ranges* to use a previously selected data range.
+
+* *Refresh every* to specify an automatic refresh rate.
++
+[role="screenshot"]
+image::concepts/images/time-filter.png[Time filter menu]
+
+. To set start and end times, click the bar next to the time filter.
+In the popup, select *Absolute*, *Relative* or *Now*, then specify the required
+options.
++
+[role="screenshot"]
+image::concepts/images/time-relative.png[Time filter showing relative time]

docs/developer/getting-started/monorepo-packages.asciidoc

@@ -65,6 +65,8 @@ yarn kbn watch-bazel
 - @kbn/apm-utils
 - @kbn/babel-preset
 - @kbn/config-schema
+- @kbn/std
 - @kbn/tinymath
 - @kbn/utility-types
+- @kbn/utils
 

docs/development/plugins/expressions/public/kibana-plugin-plugins-expressions-public.execution.interpret.md

@@ -7,7 +7,7 @@
 <b>Signature:</b>
 
 ```typescript
-interpret<T>(ast: ExpressionAstNode, input: T): Promise<unknown>;
+interpret<T>(ast: ExpressionAstNode, input: T): Observable<unknown>;
 ```
 
 ## Parameters
@@ -19,5 +19,5 @@ interpret<T>(ast: ExpressionAstNode, input: T): Promise<unknown>;
 
 <b>Returns:</b>
 
-`Promise<unknown>`
+`Observable<unknown>`
 

docs/development/plugins/expressions/public/kibana-plugin-plugins-expressions-public.execution.invokechain.md

@@ -7,7 +7,7 @@
 <b>Signature:</b>
 
 ```typescript
-invokeChain(chainArr: ExpressionAstFunction[], input: unknown): Promise<any>;
+invokeChain(chainArr: ExpressionAstFunction[], input: unknown): Observable<any>;
 ```
 
 ## Parameters
@@ -19,5 +19,5 @@ invokeChain(chainArr: ExpressionAstFunction[], input: unknown): Promise<any>;
 
 <b>Returns:</b>
 
-`Promise<any>`
+`Observable<any>`
 

docs/development/plugins/expressions/public/kibana-plugin-plugins-expressions-public.execution.invokefunction.md

@@ -7,7 +7,7 @@
 <b>Signature:</b>
 
 ```typescript
-invokeFunction(fn: ExpressionFunction, input: unknown, args: Record<string, unknown>): Promise<any>;
+invokeFunction(fn: ExpressionFunction, input: unknown, args: Record<string, unknown>): Observable<any>;
 ```
 
 ## Parameters
@@ -20,5 +20,5 @@ invokeFunction(fn: ExpressionFunction, input: unknown, args: Record<string, unkn
 
 <b>Returns:</b>
 
-`Promise<any>`
+`Observable<any>`
 

docs/development/plugins/expressions/public/kibana-plugin-plugins-expressions-public.execution.md

@@ -26,7 +26,7 @@ export declare class Execution<Input = unknown, Output = unknown, InspectorAdapt
 |  [expression](./kibana-plugin-plugins-expressions-public.execution.expression.md) |  | <code>string</code> |  |
 |  [input](./kibana-plugin-plugins-expressions-public.execution.input.md) |  | <code>Input</code> | Initial input of the execution.<!-- -->N.B. It is initialized to <code>null</code> rather than <code>undefined</code> for legacy reasons, because in legacy interpreter it was set to <code>null</code> by default. |
 |  [inspectorAdapters](./kibana-plugin-plugins-expressions-public.execution.inspectoradapters.md) |  | <code>InspectorAdapters</code> |  |
-|  [result](./kibana-plugin-plugins-expressions-public.execution.result.md) |  | <code>Promise&lt;Output &#124; ExpressionValueError&gt;</code> |  |
+|  [result](./kibana-plugin-plugins-expressions-public.execution.result.md) |  | <code>Observable&lt;Output &#124; ExpressionValueError&gt;</code> | Future that tracks result or error of this execution. |
 |  [state](./kibana-plugin-plugins-expressions-public.execution.state.md) |  | <code>ExecutionContainer&lt;Output &#124; ExpressionValueError&gt;</code> | Dynamic state of the execution. |
 
 ## Methods

docs/development/plugins/expressions/public/kibana-plugin-plugins-expressions-public.execution.resolveargs.md

@@ -7,7 +7,7 @@
 <b>Signature:</b>
 
 ```typescript
-resolveArgs(fnDef: ExpressionFunction, input: unknown, argAsts: any): Promise<any>;
+resolveArgs(fnDef: ExpressionFunction, input: unknown, argAsts: any): Observable<any>;
 ```
 
 ## Parameters
@@ -20,5 +20,5 @@ resolveArgs(fnDef: ExpressionFunction, input: unknown, argAsts: any): Promise<an
 
 <b>Returns:</b>
 
-`Promise<any>`
+`Observable<any>`
 

docs/development/plugins/expressions/public/kibana-plugin-plugins-expressions-public.execution.result.md

@@ -4,8 +4,10 @@
 
 ## Execution.result property
 
+Future that tracks result or error of this execution.
+
 <b>Signature:</b>
 
 ```typescript
-get result(): Promise<Output | ExpressionValueError>;
+readonly result: Observable<Output | ExpressionValueError>;
 ```

docs/development/plugins/expressions/public/kibana-plugin-plugins-expressions-public.execution.start.md

@@ -11,7 +11,7 @@ N.B. `input` is initialized to `null` rather than `undefined` for legacy reasons
 <b>Signature:</b>
 
 ```typescript
-start(input?: Input): void;
+start(input?: Input): Observable<Output | ExpressionValueError>;
 ```
 
 ## Parameters
@@ -22,5 +22,5 @@ start(input?: Input): void;
 
 <b>Returns:</b>
 
-`void`
+`Observable<Output | ExpressionValueError>`
 

docs/development/plugins/expressions/public/kibana-plugin-plugins-expressions-public.executor.run.md

@@ -9,7 +9,7 @@ Execute expression and return result.
 <b>Signature:</b>
 
 ```typescript
-run<Input, Output>(ast: string | ExpressionAstExpression, input: Input, params?: ExpressionExecutionParams): Promise<Output>;
+run<Input, Output>(ast: string | ExpressionAstExpression, input: Input, params?: ExpressionExecutionParams): Observable<Output | ExpressionValueError>;
 ```
 
 ## Parameters
@@ -22,5 +22,5 @@ run<Input, Output>(ast: string | ExpressionAstExpression, input: Input, params?:
 
 <b>Returns:</b>
 
-`Promise<Output>`
+`Observable<Output | ExpressionValueError>`
 

docs/development/plugins/expressions/public/kibana-plugin-plugins-expressions-public.typestring.md

@@ -11,5 +11,5 @@ If the type extends a Promise, we still need to return the string representation
 <b>Signature:</b>
 
 ```typescript
-export declare type TypeString<T> = KnownTypeToString<UnwrapPromiseOrReturn<T>>;
+export declare type TypeString<T> = KnownTypeToString<T extends ObservableLike<any> ? UnwrapObservable<T> : UnwrapPromiseOrReturn<T>>;
 ```

docs/development/plugins/expressions/server/kibana-plugin-plugins-expressions-server.execution.interpret.md

@@ -7,7 +7,7 @@
 <b>Signature:</b>
 
 ```typescript
-interpret<T>(ast: ExpressionAstNode, input: T): Promise<unknown>;
+interpret<T>(ast: ExpressionAstNode, input: T): Observable<unknown>;
 ```
 
 ## Parameters
@@ -19,5 +19,5 @@ interpret<T>(ast: ExpressionAstNode, input: T): Promise<unknown>;
 
 <b>Returns:</b>
 
-`Promise<unknown>`
+`Observable<unknown>`