Merge branch 'main' into cdn-upload

.buildkite/pipeline-utils/test-failures/annotate.ts

@@ -91,11 +91,12 @@ export const getPrComment = (
 
         const logsLink = artifactUrl ? ` [[logs]](${artifactUrl})` : '';
 
-        // job name could have #<number> in it, which Github will link to an issue, so we need to "escape" it with spans
-        return `* [[job]](${jobUrl})${logsLink} ${failure.jobName.replace(
-          '#',
-          '#<span></span>'
-        )} / ${failure.name}`;
+        // failure name could have #<number>, which Github will link to an issue or @<string>,
+        // which will send a notification so we need to "escape" it with spans
+        const failureString = `${failure.jobName} / ${failure.name}`
+          .replaceAll('#', '#<span></span>')
+          .replaceAll('@', '@<span></span>');
+        return `* [[job]](${jobUrl})${logsLink} ${failureString}`;
       })
       .join('\n')
   );

.buildkite/scripts/steps/artifacts/docker_context.sh

@@ -23,11 +23,7 @@ case $KIBANA_DOCKER_CONTEXT in
   cloud)
     DOCKER_CONTEXT_FILE="kibana-cloud-$FULL_VERSION-docker-build-context.tar.gz"
   ;;
-  ubi8)
-    DOCKER_CONTEXT_FILE="kibana-ubi8-$FULL_VERSION-docker-build-context.tar.gz"
-  ;;
   ubi)
-    # Currently ubi9.  After ubi8 we're moving to a version agnostic filename
     DOCKER_CONTEXT_FILE="kibana-ubi-$FULL_VERSION-docker-build-context.tar.gz"
   ;;
   ironbank)

.buildkite/scripts/steps/artifacts/publish.sh

@@ -20,7 +20,7 @@ download "kibana-$FULL_VERSION-docker-image.tar.gz"
 download "kibana-$FULL_VERSION-docker-image-aarch64.tar.gz"
 download "kibana-cloud-$FULL_VERSION-docker-image.tar.gz"
 download "kibana-cloud-$FULL_VERSION-docker-image-aarch64.tar.gz"
-download "kibana-ubi8-$FULL_VERSION-docker-image.tar.gz"
+download "kibana-ubi-$FULL_VERSION-docker-image.tar.gz"
 
 download "kibana-$FULL_VERSION-arm64.deb"
 download "kibana-$FULL_VERSION-amd64.deb"
@@ -30,7 +30,7 @@ download "kibana-$FULL_VERSION-aarch64.rpm"
 download "kibana-$FULL_VERSION-docker-build-context.tar.gz"
 download "kibana-cloud-$FULL_VERSION-docker-build-context.tar.gz"
 download "kibana-ironbank-$FULL_VERSION-docker-build-context.tar.gz"
-download "kibana-ubi8-$FULL_VERSION-docker-build-context.tar.gz"
+download "kibana-ubi-$FULL_VERSION-docker-build-context.tar.gz"
 
 download "kibana-$FULL_VERSION-linux-aarch64.tar.gz"
 download "kibana-$FULL_VERSION-linux-x86_64.tar.gz"

docs/concepts/esql.asciidoc

@@ -1,7 +1,7 @@
 [[esql]]
 === {esql}
 
-preview::[]
+preview::["Do not use {esql} on production environments. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features."]
 
 The Elasticsearch Query Language, {esql}, has been created to make exploring your data faster and easier using the **Discover** application. From version 8.11 you can try this new feature, which is enabled by default. 
 

docs/discover/try-esql.asciidoc

@@ -1,7 +1,7 @@
 [[try-esql]]
 == Try {esql}
 
-preview::[]
+preview::["Do not use {esql} on production environments. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features."]
 
 The Elasticsearch Query Language, {esql}, makes it easier to explore your data without leaving Discover. 
 

docs/user/alerting/rule-types/es-query.asciidoc

@@ -44,7 +44,7 @@ For example:
 If you use {kibana-ref}/kuery-query.html[KQL] or {kibana-ref}/lucene-query.html[Lucene], you must specify a data view then define a text-based query.
 For example, `http.request.referrer: "https://example.com"`.
 
-preview:[] If you use {ref}/esql.html[ES|QL], you must provide a source command followed by an optional series of processing commands, separated by pipe characters (|).
+preview:["Do not use {esql} on production environments. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features."] If you use {ref}/esql.html[ES|QL], you must provide a source command followed by an optional series of processing commands, separated by pipe characters (|).
 For example:
 
 [source,sh]

fleet_packages.json

@@ -56,6 +56,6 @@
   },
   {
     "name": "security_detection_engine",
-    "version": "8.12.1"
+    "version": "8.12.2"
   }
 ]

package.json

@@ -1111,6 +1111,7 @@
     "vega-spec-injector": "^0.0.2",
     "vega-tooltip": "^0.28.0",
     "vinyl": "^2.2.0",
+    "wellknown": "^0.5.0",
     "whatwg-fetch": "^3.0.0",
     "xml2js": "^0.5.0",
     "xstate": "^4.38.2",
@@ -1582,7 +1583,7 @@
     "jsondiffpatch": "0.4.1",
     "license-checker": "^25.0.1",
     "listr": "^0.14.1",
-    "lmdb": "^2.6.9",
+    "lmdb": "^2.9.2",
     "loader-utils": "^2.0.4",
     "marge": "^1.0.1",
     "micromatch": "^4.0.5",

packages/kbn-es-query/index.ts

@@ -55,6 +55,7 @@ export {
   getAggregateQueryMode,
   getIndexPatternFromSQLQuery,
   getIndexPatternFromESQLQuery,
+  getLimitFromESQLQuery,
   getLanguageDisplayName,
   cleanupESQLQueryForLensSuggestions,
 } from './src/es_query';

packages/kbn-es-query/src/es_query/es_aggregate_query.test.ts

@@ -12,6 +12,7 @@ import {
   getAggregateQueryMode,
   getIndexPatternFromSQLQuery,
   getIndexPatternFromESQLQuery,
+  getLimitFromESQLQuery,
   cleanupESQLQueryForLensSuggestions,
 } from './es_aggregate_query';
 
@@ -117,6 +118,33 @@ describe('sql query helpers', () => {
     });
   });
 
+  describe('getLimitFromESQLQuery', () => {
+    it('should return default limit when ES|QL query is empty', () => {
+      const limit = getLimitFromESQLQuery('');
+      expect(limit).toBe(500);
+    });
+
+    it('should return default limit when ES|QL query does not contain LIMIT command', () => {
+      const limit = getLimitFromESQLQuery('FROM foo');
+      expect(limit).toBe(500);
+    });
+
+    it('should return default limit when ES|QL query contains invalid LIMIT command', () => {
+      const limit = getLimitFromESQLQuery('FROM foo | LIMIT iAmNotANumber');
+      expect(limit).toBe(500);
+    });
+
+    it('should return limit when ES|QL query contains LIMIT command', () => {
+      const limit = getLimitFromESQLQuery('FROM foo | LIMIT 10000 | KEEP myField');
+      expect(limit).toBe(10000);
+    });
+
+    it('should return last limit when ES|QL query contains multiple LIMIT command', () => {
+      const limit = getLimitFromESQLQuery('FROM foo | LIMIT 200 | LIMIT 0');
+      expect(limit).toBe(0);
+    });
+  });
+
   describe('cleanupESQLQueryForLensSuggestions', () => {
     it('should not remove anything if a drop command is not present', () => {
       expect(cleanupESQLQueryForLensSuggestions('from a | eval b = 1')).toBe('from a | eval b = 1');

packages/kbn-es-query/src/es_query/es_aggregate_query.ts

@@ -5,10 +5,13 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
+
 import type { Query, AggregateQuery } from '../filters';
 
 type Language = keyof AggregateQuery;
 
+const DEFAULT_ESQL_LIMIT = 500;
+
 // Checks if the query is of type Query
 export function isOfQueryType(arg?: Query | AggregateQuery): arg is Query {
   return Boolean(arg && 'query' in arg);
@@ -67,6 +70,17 @@ export function getIndexPatternFromESQLQuery(esql?: string): string {
   return '';
 }
 
+export function getLimitFromESQLQuery(esql: string): number {
+  const limitCommands = esql.match(new RegExp(/LIMIT\s[0-9]+/, 'ig'));
+  if (!limitCommands) {
+    return DEFAULT_ESQL_LIMIT;
+  }
+
+  const lastIndex = limitCommands.length - 1;
+  const split = limitCommands[lastIndex].split(' ');
+  return parseInt(split[1], 10);
+}
+
 export function cleanupESQLQueryForLensSuggestions(esql?: string): string {
   const pipes = (esql || '').split('|');
   return pipes.filter((statement) => !/DROP\s/i.test(statement)).join('|');

packages/kbn-es-query/src/es_query/index.ts

@@ -20,6 +20,7 @@ export {
   getIndexPatternFromSQLQuery,
   getLanguageDisplayName,
   getIndexPatternFromESQLQuery,
+  getLimitFromESQLQuery,
   cleanupESQLQueryForLensSuggestions,
 } from './es_aggregate_query';
 export { fromCombinedFilter } from './from_combined_filter';

packages/kbn-es-types/index.ts

@@ -19,4 +19,7 @@ export type {
   ESFilter,
   MaybeReadonlyArray,
   ClusterDetails,
+  ESQLColumn,
+  ESQLRow,
+  ESQLSearchReponse,
 } from './src';

packages/kbn-es-types/src/index.ts

@@ -12,6 +12,9 @@ import {
   AggregateOfMap as AggregationResultOfMap,
   SearchHit,
   ClusterDetails,
+  ESQLColumn,
+  ESQLRow,
+  ESQLSearchReponse,
 } from './search';
 
 export type ESFilter = estypes.QueryDslQueryContainer;
@@ -41,4 +44,7 @@ export type {
   AggregationResultOfMap,
   SearchHit,
   ClusterDetails,
+  ESQLColumn,
+  ESQLRow,
+  ESQLSearchReponse,
 };

packages/kbn-es-types/src/search.ts

@@ -653,3 +653,15 @@ export interface ClusterDetails {
   _shards?: estypes.ShardStatistics;
   failures?: estypes.ShardFailure[];
 }
+
+export interface ESQLColumn {
+  name: string;
+  type: string;
+}
+
+export type ESQLRow = unknown[];
+
+export interface ESQLSearchReponse {
+  columns: ESQLColumn[];
+  values: ESQLRow[];
+}

packages/kbn-text-based-editor/src/editor_footer.tsx

@@ -200,6 +200,7 @@ interface EditorFooterProps {
   disableSubmitAction?: boolean;
   editorIsInline?: boolean;
   isSpaceReduced?: boolean;
+  isLoading?: boolean;
 }
 
 export const EditorFooter = memo(function EditorFooter({
@@ -214,6 +215,7 @@ export const EditorFooter = memo(function EditorFooter({
   disableSubmitAction,
   editorIsInline,
   isSpaceReduced,
+  isLoading,
 }: EditorFooterProps) {
   const { euiTheme } = useEuiTheme();
   const [isErrorPopoverOpen, setIsErrorPopoverOpen] = useState(false);
@@ -331,6 +333,7 @@ export const EditorFooter = memo(function EditorFooter({
                   size="s"
                   fill
                   onClick={runQuery}
+                  isLoading={isLoading}
                   isDisabled={Boolean(disableSubmitAction)}
                   data-test-subj="TextBasedLangEditor-run-query-button"
                   minWidth={isSpaceReduced ? false : undefined}

packages/kbn-text-based-editor/src/text_based_languages_editor.tsx

@@ -86,6 +86,8 @@ export interface TextBasedLanguagesEditorProps {
   errors?: Error[];
   /** Warning string as it comes from ES */
   warning?: string;
+  /** Disables the editor and displays loading icon in run button */
+  isLoading?: boolean;
   /** Disables the editor */
   isDisabled?: boolean;
   /** Indicator if the editor is on dark mode */
@@ -149,6 +151,7 @@ export const TextBasedLanguagesEditor = memo(function TextBasedLanguagesEditor({
   detectTimestamp = false,
   errors: serverErrors,
   warning: serverWarning,
+  isLoading,
   isDisabled,
   isDarkMode,
   hideMinimizeButton,
@@ -540,7 +543,9 @@ export const TextBasedLanguagesEditor = memo(function TextBasedLanguagesEditor({
     },
     overviewRulerBorder: false,
     readOnly:
-      isDisabled || Boolean(!isCompactFocused && codeOneLiner && codeOneLiner.includes('...')),
+      isLoading ||
+      isDisabled ||
+      Boolean(!isCompactFocused && codeOneLiner && codeOneLiner.includes('...')),
   };
 
   if (isCompactFocused) {
@@ -836,6 +841,7 @@ export const TextBasedLanguagesEditor = memo(function TextBasedLanguagesEditor({
                         disableSubmitAction={disableSubmitAction}
                         hideRunQueryText={hideRunQueryText}
                         isSpaceReduced={isSpaceReduced}
+                        isLoading={isLoading}
                       />
                     )}
                   </div>
@@ -925,6 +931,7 @@ export const TextBasedLanguagesEditor = memo(function TextBasedLanguagesEditor({
           editorIsInline={editorIsInline}
           disableSubmitAction={disableSubmitAction}
           isSpaceReduced={isSpaceReduced}
+          isLoading={isLoading}
           {...editorMessages}
         />
       )}