Merge branch 'master' of github.com:elastic/kibana into usage_collect…

…ion/changed_config

src/plugins/kibana_react/public/toolbar_button/toolbar_button.scss

@@ -2,8 +2,13 @@
   line-height: $euiButtonHeight; // Keeps alignment of text and chart icon
   background-color: $euiColorEmptyShade;
 
+  // todo: once issue https://github.com/elastic/eui/issues/4730 is merged, this code might be safe to remove
   // Some toolbar buttons are just icons, but EuiButton comes with margin and min-width that need to be removed
   min-width: 0;
+  @include kbnThemeStyle('v8') {
+    border-width: $euiBorderWidthThin;
+    border-style: solid;
+  }
 
   &[class*='--text'] {
     // Lighten the border color for all states

src/plugins/kibana_usage_collection/server/collectors/application_usage/schema.ts

@@ -148,6 +148,7 @@ export const applicationUsageSchema = {
   ml: commonSchema,
   monitoring: commonSchema,
   'observability-overview': commonSchema,
+  osquery: commonSchema,
   security_account: commonSchema,
   security_access_agreement: commonSchema,
   security_capture_url: commonSchema, // It's a forward app so we'll likely never report it

src/plugins/telemetry/schema/oss_plugins.json

@@ -3954,6 +3954,137 @@
             }
           }
         },
+        "osquery": {
+          "properties": {
+            "appId": {
+              "type": "keyword",
+              "_meta": {
+                "description": "The application being tracked"
+              }
+            },
+            "viewId": {
+              "type": "keyword",
+              "_meta": {
+                "description": "Always `main`"
+              }
+            },
+            "clicks_total": {
+              "type": "long",
+              "_meta": {
+                "description": "General number of clicks in the application since we started counting them"
+              }
+            },
+            "clicks_7_days": {
+              "type": "long",
+              "_meta": {
+                "description": "General number of clicks in the application over the last 7 days"
+              }
+            },
+            "clicks_30_days": {
+              "type": "long",
+              "_meta": {
+                "description": "General number of clicks in the application over the last 30 days"
+              }
+            },
+            "clicks_90_days": {
+              "type": "long",
+              "_meta": {
+                "description": "General number of clicks in the application over the last 90 days"
+              }
+            },
+            "minutes_on_screen_total": {
+              "type": "float",
+              "_meta": {
+                "description": "Minutes the application is active and on-screen since we started counting them."
+              }
+            },
+            "minutes_on_screen_7_days": {
+              "type": "float",
+              "_meta": {
+                "description": "Minutes the application is active and on-screen over the last 7 days"
+              }
+            },
+            "minutes_on_screen_30_days": {
+              "type": "float",
+              "_meta": {
+                "description": "Minutes the application is active and on-screen over the last 30 days"
+              }
+            },
+            "minutes_on_screen_90_days": {
+              "type": "float",
+              "_meta": {
+                "description": "Minutes the application is active and on-screen over the last 90 days"
+              }
+            },
+            "views": {
+              "type": "array",
+              "items": {
+                "properties": {
+                  "appId": {
+                    "type": "keyword",
+                    "_meta": {
+                      "description": "The application being tracked"
+                    }
+                  },
+                  "viewId": {
+                    "type": "keyword",
+                    "_meta": {
+                      "description": "The application view being tracked"
+                    }
+                  },
+                  "clicks_total": {
+                    "type": "long",
+                    "_meta": {
+                      "description": "General number of clicks in the application sub view since we started counting them"
+                    }
+                  },
+                  "clicks_7_days": {
+                    "type": "long",
+                    "_meta": {
+                      "description": "General number of clicks in the active application sub view over the last 7 days"
+                    }
+                  },
+                  "clicks_30_days": {
+                    "type": "long",
+                    "_meta": {
+                      "description": "General number of clicks in the active application sub view over the last 30 days"
+                    }
+                  },
+                  "clicks_90_days": {
+                    "type": "long",
+                    "_meta": {
+                      "description": "General number of clicks in the active application sub view over the last 90 days"
+                    }
+                  },
+                  "minutes_on_screen_total": {
+                    "type": "float",
+                    "_meta": {
+                      "description": "Minutes the application sub view is active and on-screen since we started counting them."
+                    }
+                  },
+                  "minutes_on_screen_7_days": {
+                    "type": "float",
+                    "_meta": {
+                      "description": "Minutes the application is active and on-screen active application sub view over the last 7 days"
+                    }
+                  },
+                  "minutes_on_screen_30_days": {
+                    "type": "float",
+                    "_meta": {
+                      "description": "Minutes the application is active and on-screen active application sub view over the last 30 days"
+                    }
+                  },
+                  "minutes_on_screen_90_days": {
+                    "type": "float",
+                    "_meta": {
+                      "description": "Minutes the application is active and on-screen active application sub view over the last 90 days"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },        
         "security_account": {
           "properties": {
             "appId": {

src/plugins/vis_type_table/public/components/table_visualization.scss

@@ -12,6 +12,15 @@
   overflow: auto;
 
   @include euiScrollBar;
+
+  // Sticky footer doesn't correct work with inline-flex in Firefox.
+  // As footer the last element I don't see any reason to use inline-flex for this element.
+  // Display: flex fixes jumping on hover in Firefox.
+  // Created issue on EUI (https://github.com/elastic/eui/issues/4729).
+  // Once addressed, we can remove this local fix.
+  .euiDataGrid--stickyFooter .euiDataGridFooter {
+    display: flex;
+  }
 }
 
 .tbvChart__split {

src/plugins/vis_type_timelion/common/types.ts

@@ -16,6 +16,7 @@ export interface TimelionFunctionArgsSuggestion {
 export interface TimelionFunctionArgs {
   name: string;
   help?: string;
+  insertText?: string;
   multi?: boolean;
   types: TimelionFunctionArgsTypes[];
   suggestions?: TimelionFunctionArgsSuggestion[];

src/plugins/vis_type_timelion/public/components/timelion_expression_input_helpers.ts

@@ -244,10 +244,9 @@ export function getSuggestion(
 
       break;
     case SUGGESTION_TYPE.ARGUMENT_VALUE:
-      const param = suggestion.name.split(':');
-
-      if (param.length === 1 || param[1]) {
-        insertText = `${param.length === 1 ? insertText : param[1]},`;
+      const defaultText = (suggestion as TimelionFunctionArgs).insertText;
+      if (defaultText) {
+        insertText = `${defaultText},`;
       }
 
       command = {

src/plugins/vis_type_timelion/public/helpers/arg_value_suggestions.ts

@@ -51,6 +51,7 @@ export function getArgValueSuggestions() {
 
         return (await indexPatterns.find(search, size)).map(({ title }) => ({
           name: title,
+          insertText: title,
         }));
       },
       async metric(partial: string, functionArgs: TimelionExpressionFunction[]) {
@@ -81,7 +82,14 @@ export function getArgValueSuggestions() {
               containsFieldName(valueSplit[1], field) &&
               !indexPatternsUtils.isNestedField(field)
           )
-          .map((field) => ({ name: `${valueSplit[0]}:${field.name}`, help: field.type }));
+          .map((field) => {
+            const suggestionValue = field.name.replaceAll(':', '\\:');
+            return {
+              name: `${valueSplit[0]}:${suggestionValue}`,
+              help: field.type,
+              insertText: suggestionValue,
+            };
+          });
       },
       async split(partial: string, functionArgs: TimelionExpressionFunction[]) {
         const indexPattern = await getIndexPattern(functionArgs);
@@ -105,7 +113,7 @@ export function getArgValueSuggestions() {
               containsFieldName(partial, field) &&
               !indexPatternsUtils.isNestedField(field)
           )
-          .map((field) => ({ name: field.name, help: field.type }));
+          .map((field) => ({ name: field.name, help: field.type, insertText: field.name }));
       },
       async timefield(partial: string, functionArgs: TimelionExpressionFunction[]) {
         const indexPattern = await getIndexPattern(functionArgs);
@@ -121,7 +129,7 @@ export function getArgValueSuggestions() {
               containsFieldName(partial, field) &&
               !indexPatternsUtils.isNestedField(field)
           )
-          .map((field) => ({ name: field.name }));
+          .map((field) => ({ name: field.name, insertText: field.name }));
       },
     },
   };

src/plugins/vis_type_timelion/server/series_functions/es/es.test.js

@@ -123,13 +123,35 @@ describe('es', () => {
       const emptyScriptedFields = [];
 
       test('adds a metric agg for each metric', () => {
-        config.metric = ['sum:beer', 'avg:bytes', 'percentiles:bytes'];
+        config.metric = [
+          'sum:beer',
+          'avg:bytes',
+          'percentiles:bytes',
+          'cardinality:\\:sample',
+          'sum:\\:beer',
+          'percentiles:\\:\\:bytes:1.2,1.3,2.7',
+          'percentiles:\\:bytes\\:123:20.0,50.0,100.0',
+          'percentiles:a:2',
+        ];
         agg = createDateAgg(config, tlConfig, emptyScriptedFields);
         expect(agg.time_buckets.aggs['sum(beer)']).toEqual({ sum: { field: 'beer' } });
         expect(agg.time_buckets.aggs['avg(bytes)']).toEqual({ avg: { field: 'bytes' } });
         expect(agg.time_buckets.aggs['percentiles(bytes)']).toEqual({
           percentiles: { field: 'bytes' },
         });
+        expect(agg.time_buckets.aggs['cardinality(:sample)']).toEqual({
+          cardinality: { field: ':sample' },
+        });
+        expect(agg.time_buckets.aggs['sum(:beer)']).toEqual({ sum: { field: ':beer' } });
+        expect(agg.time_buckets.aggs['percentiles(::bytes)']).toEqual({
+          percentiles: { field: '::bytes', percents: [1.2, 1.3, 2.7] },
+        });
+        expect(agg.time_buckets.aggs['percentiles(:bytes:123)']).toEqual({
+          percentiles: { field: ':bytes:123', percents: [20.0, 50.0, 100.0] },
+        });
+        expect(agg.time_buckets.aggs['percentiles(a)']).toEqual({
+          percentiles: { field: 'a', percents: [2] },
+        });
       });
 
       test('adds a scripted metric agg for each scripted metric', () => {
@@ -158,6 +180,13 @@ describe('es', () => {
         expect(typeof agg.time_buckets.aggs.count.bucket_script).toBe('object');
         expect(agg.time_buckets.aggs.count.bucket_script.buckets_path).toEqual('_count');
       });
+
+      test('has a special `count` metric with redundant field which use a script', () => {
+        config.metric = ['count:beer'];
+        agg = createDateAgg(config, tlConfig, emptyScriptedFields);
+        expect(typeof agg.time_buckets.aggs.count.bucket_script).toBe('object');
+        expect(agg.time_buckets.aggs.count.bucket_script.buckets_path).toEqual('_count');
+      });
     });
   });
 
@@ -305,10 +334,10 @@ describe('es', () => {
 
     describe('config.split', () => {
       test('adds terms aggs, in order, under the filters agg', () => {
-        config.split = ['beer:5', 'wine:10'];
+        config.split = ['beer:5', 'wine:10', ':lemo:nade::15', ':jui:ce:723::45'];
         const request = fn(config, tlConfig, emptyScriptedFields);
 
-        const aggs = request.params.body.aggs.q.aggs;
+        let aggs = request.params.body.aggs.q.aggs;
 
         expect(aggs.beer.meta.type).toEqual('split');
         expect(aggs.beer.terms.field).toEqual('beer');
@@ -317,6 +346,18 @@ describe('es', () => {
         expect(aggs.beer.aggs.wine.meta.type).toEqual('split');
         expect(aggs.beer.aggs.wine.terms.field).toEqual('wine');
         expect(aggs.beer.aggs.wine.terms.size).toEqual(10);
+
+        aggs = aggs.beer.aggs.wine.aggs;
+        expect(aggs).toHaveProperty(':lemo:nade:');
+        expect(aggs[':lemo:nade:'].meta.type).toEqual('split');
+        expect(aggs[':lemo:nade:'].terms.field).toEqual(':lemo:nade:');
+        expect(aggs[':lemo:nade:'].terms.size).toEqual(15);
+
+        aggs = aggs[':lemo:nade:'].aggs;
+        expect(aggs).toHaveProperty(':jui:ce:723:');
+        expect(aggs[':jui:ce:723:'].meta.type).toEqual('split');
+        expect(aggs[':jui:ce:723:'].terms.field).toEqual(':jui:ce:723:');
+        expect(aggs[':jui:ce:723:'].terms.size).toEqual(45);
       });
 
       test('adds scripted terms aggs, in order, under the filters agg', () => {

src/plugins/vis_type_timelion/server/series_functions/es/lib/build_request.js

@@ -48,17 +48,17 @@ export default function buildRequest(config, tlConfig, scriptedFields, timeout)
 
   let aggCursor = aggs.q.aggs;
 
-  _.each(config.split, function (clause) {
-    clause = clause.split(':');
-    if (clause[0] && clause[1]) {
-      const termsAgg = buildAggBody(clause[0], scriptedFields);
-      termsAgg.size = parseInt(clause[1], 10);
-      aggCursor[clause[0]] = {
+  (config.split || []).forEach((clause) => {
+    const [field, arg] = clause.split(/:(\d+$)/);
+    if (field && arg) {
+      const termsAgg = buildAggBody(field, scriptedFields);
+      termsAgg.size = parseInt(arg, 10);
+      aggCursor[field] = {
         meta: { type: 'split' },
         terms: termsAgg,
         aggs: {},
       };
-      aggCursor = aggCursor[clause[0]].aggs;
+      aggCursor = aggCursor[field].aggs;
     } else {
       throw new Error('`split` requires field:limit');
     }